Security is not a product, but a process.

learn more… | top users | synonyms (1)

2
votes
2answers
28 views

Does Active Directory send a user's access token across the network?

Question: does AD send a user's access token across the network? Research: The following two passages contradict themselves--given that TGTs are transmitted across the network by design. From the ...
0
votes
0answers
25 views

Web server got compromised (What to do next?) [duplicate]

My webserver got compromised (I think). The last 3 days inbound traffic spiked up to abnormal levels, in 3 days +/- 2.5TB of bandwith got used. when reading my access logs I see thousands of requests ...
0
votes
0answers
17 views

FTP server secured by denying write permission to chrooted home directory (virtual users) [on hold]

I have a Pure-Ftpd server configured in a way that users have no write access to their ftp root directory. Instead user can write only to subdirectory created within its home dir (this subdir is ...
0
votes
3answers
60 views

Are there any disadvantages of blocking port 80 for security reasons?

To improve security, we would like to make https access to all customer sites that we host mandantory, and guarantee this in our terms and conditions. The problem is that currently the Apache ...
0
votes
0answers
13 views

FTP file upload positive or negative file extension list

I'm setting up an FTP on IIS and I want user's to not be able to upload possible dangerous files based on file extensions. Now I'm uncertain if I should create a positive list to allow or negative ...
-1
votes
1answer
20 views

Updating Ubuntu Webserver

Our webserver is on AWS running on Ubuntu 14.04.3 LTS. When I ssh into the server I see this message. 196 packages can be updated. 123 updates are security updates. Should I update our ...
-1
votes
0answers
6 views

How safe are proxies if your IP could be cross-referenced? [migrated]

Let's say you're the NSA. And let's say you have "backdoor" access (for the sake of this discussion we'll assume that includes at a minimum the mapping of an IP address to a logged-in user) to Google. ...
0
votes
0answers
13 views

Tracking filesystem changes in runtime

I need to have program that tracks changes made to the file e.g. when I am installing software from supplied installer instead of packages. I do not want to checksum every file in filesystem because ...
-4
votes
0answers
26 views

Circumventing web restrictions [closed]

One of my network users is trying to circumvent web access restrictions to access Google Talk service. I have enough evidence including key strikes and passwords to talk to the user in but I'm still ...
1
vote
1answer
28 views

Security of SSL certs on AWS ELBs / SSL offloading

I have some concerns about security and am wondering how AWS will store an SSL certificate deployed to an ELB. I have a wildcard SSL cert for my domain that I want to make sure doesn't persist ...
0
votes
0answers
16 views

Arch Linux install without root password

Is it possible to install (and later maintain) Arch Linux (or some of its derivatives) without ever setting root password - using only user account and sudo? The same way it's done in Ubuntu and many ...
-1
votes
0answers
28 views

Security and chaining firewall, very specific scenario [closed]

I'm in a very specific scenario where i need to secure as much as possible a single server in a Datacenter connected only to the internet (no company network, just a lone Windows Server computer alone ...
1
vote
1answer
74 views

Every website on the server redirects to a foreign page, even after clean install

First of all, this is my first time posting here, so sorry if I posted in the wrong section. To get to the point: I have a CentOS 7 + Gnome server, with VestaCP configured and running 2 WordPress ...
0
votes
1answer
19 views

How make Docker auto-survive kernel upgrades and restart?

Brief question: Docker, Ubuntu 16.04, auto-security-upgrades & reboot. Then how can I ensure the newest linux-image-extra-`uname -r` has been installed before Docker attempts to start the ...
0
votes
0answers
7 views

Is mod_evasive on ajax application a good idea, or will it block on false negatives?

I have a web application that injects content into the users page dynamically via ajax at the click of a button. A user may click the button multiple time in quick succession. In increasing the ...
0
votes
1answer
22 views

Integrating Web Application Firewall into this architecture

I need some help figuring out how to implement a Web Application Firewall (WAF) in my existing architecture. Currently I have 2 HAproxy servers clustered using keepalived which are responsible for ...
0
votes
1answer
46 views

Kali Linux Running in AWS

Normally I run Kali in a virtualbox VM however due to the nature of a project it may be useful to run Kali from an AWS EC2 instance. So imagine my joy when I learned there was a Kali AMI only to be ...
0
votes
1answer
22 views

Windows 2008 server SMB security

My understanding is that if I use .net System.IO namespace to write files to a remote file share it eventually uses kernel32.dll and SMB protocol is used behind the scene. Let's say both source and ...
-1
votes
0answers
34 views

OpenVPN gateways configuration with non-routable addresses

I have to configure OpenVPN gateways with cryptographically protected tunnel connecting two non-routable subnet addresses. Mutual authentication gates on the basis of certificates. I used this ...
0
votes
2answers
36 views

Find out exactly what (which php script) is trying to send spam from server

Last night my server was compromised (I guess - one of outdated PHP CMS's) and many spam messages were sent. I have restricted access to Postfix (via authorized_submit_users directive in main.cf) ...
-2
votes
1answer
43 views

Blocking IP Addresses dynamically without any software [duplicate]

I'm no expert in reading logs, so I posted some of my log today at another forum answered: DDOS Attack. This is what I've done so far: copied all sys logs, kern log , ufw log & auth log in one ...
1
vote
3answers
100 views

How to simulate a WORM environment w/Active Directory/NTFS

In NTFS/Active Directory, assume I have two drives mapped: H:\ I:\ Users can edit files in H:\, but not in I:\ . I want users to be able to, using a script, move their files to the I:\ drive unless ...
1
vote
2answers
46 views

Block SSH hop based on traffic origin?

Is there a way to find where the SSH traffic origins from? We have two servers A and B. A is on a private network. B has 2 nics, private and public. A can SSH into B and B can SSH into A problem is, ...
0
votes
0answers
20 views

A domain controller in Azure ends up public on the Internet with no firewall - is it compromised? [duplicate]

I'm helping a customer stand up an Azure environment and they decided to stand up a server (DC) on their own without asking for help. The only access method is supposed to be IPsec, but they forgot ...
0
votes
0answers
54 views

Restricting NetBIOS Access

There is a Windows Server in the domain. It has folders NetBIOS shares for users to access. It also plays the role of Remote Desktop via RDP. How can I keep all of these services advertised but ...
0
votes
0answers
17 views

Wordpress Access Logs

I've recently had a wordpress site compromised and the www-data user was able to create new files in the webroot. After looking at the apache acess logs I've found the following request which seems a ...
1
vote
1answer
43 views

How to install secrets safely on EC2 instances?

Context: Setting up an infra with some Auto-scaling groups and some non-scaling self-standing VMs. Some roles need secrets (private keys) which should be restricted to root or to specific users. ...
2
votes
0answers
35 views

Apache 2.4.20 and “SeverTokens Prod” causes “segmentation fault”

Simply stated I am running Apache 2.4.20 on CentOs 6 and am in the process of hardening this VM prior to rolling it out. I added this line: ServerTokens ProductOnly Which on restart promptly gave ...
0
votes
1answer
35 views

Shared hosting server sites showing up suspicious results on google [closed]

I seem to have found loads of hacked websites on a shared hosting server, or at least something really strange must have happened. The server company refuses to admit there is anything wrong, so I ...
-7
votes
1answer
121 views

SysWOW64 access denied (Windows Server 2012 Standard) [closed]

I am trying to call: [System.IO.File]::Delete($folder) from the Powershell ISE (not ISEx86). I am logged in as Domain User that is an Administrator on this machine to which I connect using RDP. I ...
0
votes
1answer
13 views

System Center 2012 Security

I installed the entire System Center 2012 Suite and I run the Database on it's own machine. During installation I noticed you could use specific user(s) on the install and setup for each of the ...
0
votes
1answer
22 views

How to disable systemcalls in ftp environment with vsftpd?

I've set up a vsftpd server with local users jailed within their home directories. Anyhow if I connect through a ftp client I can execute systemcalls with the "!" command. How can I configure vsftpd ...
0
votes
2answers
50 views

Is there a way in Linux where one non root user can check if another non root user is using OpenSSL or not without sudo permission?

Consider this scenario where User-A and User-B are both non-root user are running inside a server. User-A is running different Program P1 (pid-2814),P2(pid-2815) whereas User-B is running different ...
0
votes
0answers
26 views

Does Docker's CAP_NET_ADMIN allow a container to affect the host network, or only it's own?

I have a docker container running a password authenticated SFTP server (client requirement - I've already lost that battle). In order to mitigate the risk of brute force attacks, I had thought to ...
-1
votes
1answer
33 views

Restrict a program to only access files in a specific folder not containing it

I have a folder F and a program P outside of the folder F. How to make P only able to access files in F? Answers for any OS are accepted but preferably something that work in Debian. E.g F is ~/...
1
vote
0answers
35 views

Someone Uploaded PHP Backdoor to Wordpress Site [duplicate]

I have enough security that I was alerted to a PHP backdoor that was uploaded to a WordPress site hosted on one of my servers. It was removed within minutes of being uploaded so no damage was done. No ...
-1
votes
0answers
22 views

KVM CPU features security risk or performance benefit

I need to run an untrusted VM with libvirt and KVM and need decent performance. When I run virsh capabilities to see what my CPU can provide, I get: <cpu> <arch>x86_64</arch&...
-1
votes
1answer
29 views

How do I execute monit commands from a shell script without root access?

I've installed and configured monit on a Debian server and opened the http service to localhost and gave rw permissions to the group "monit". I created this group and added myself to this group. The ...
4
votes
1answer
168 views

How to secure a docker host to not allow rooting

I am trying to make docker on a server more secure. The main problem is that most people say "if a person has access to docker, they can be root too" for an administrator point of few this is not ...
0
votes
1answer
33 views

Does the following Apache Webserver configuration block access to all URLs except one?

I am trying to prevent access to my web site except for access to the single URL "/ws/public" that everyone is allowed to view. I am running Apache WebServer in front of an Apache Tomcat which is ...
-2
votes
1answer
25 views

Windows server Allow and deny [closed]

What is the deal with this. According to my count there are for possible permissions allow (checked) deny (checked) not allow (empty) deny (checked) allow (checked) deny( empty) allow (empty) deny (...
0
votes
0answers
60 views

Site unreachable due to attack - xmlrpc.php

Today our server was not reachable. It was returning a 502. We are running Nginx 1.10 on Ubuntu 14.04. We also use PHP7 (only, no PHP5). In the logs, we got the same error from the same client (2 ...
0
votes
0answers
11 views

activate geoip settings when certain locations detected

I have a website that is attacked from time to time by ddos attackers. Such attack can disable the webpage for days. The webpage serves for few countries so if I know about the attack, the solution is ...
0
votes
0answers
26 views

Win Server 2003, security permissions are reset by SYSTEM. Why?

I've got a Windows Server 2003 with a physical drive (let's say Z:/) It's shared within my company. In the past two days the users were complaining that they do not have access to files on that drive. ...
1
vote
0answers
28 views

Install Mod_Security for Nginx without need to recompile

I've got LEMP all setup. Now I would like to add mod_security. I tried to research but all I could find are instructions on how to recompile nginx. Is there a way to add mod_security without needing ...
1
vote
1answer
45 views

Digital signature with openssl

I am trying to sign and verify a signature using an RSA key-pair. Here is how I generate the key pair (which work fine for encryption / decryption): ssh-keygen -t rsa -f mykey -N '' -b 2048 mv ...
0
votes
1answer
51 views

Network maps, best admin practises and how them saved your ass?

I am reviewing the security of a (quite large) network. There are a some thousands switches, several hundred routers, several hundred access points, tenths of FW, IPS, and so on. PCs and servers are ...
0
votes
0answers
29 views

Zentyal - Samba Issue : A logged in user cannot access home folder

0 down vote favorite I have a very strange issue : I can login to my domain with my username/password and when i try to access my home folder (lets say \Knosos\myname ) i receive an access denied ...
1
vote
1answer
34 views

Secure AD Access

I was just trying to access and Active Directory-Server via php (ldap) to be able to use Windows credentials for a Website Login. I did this using xampp on my standard Windows connecting to a Windows ...