4
votes
7answers
986 views

will hosting provider have access to my dedicated server?

I am looking to buy a dedicated server for my web application.But I am concerned about security to my application code and who can access to my server even dedicated server.As hosting provider ...
0
votes
1answer
31 views

In apache how do you validate that the logged in username matches the directory name?

Sometimes you want to setup a directory structure in apache such that logged in users can only see their own directory. (i.e. the directory name and the username match.) What do you put in the ...
5
votes
4answers
64 views

sshd logging attempts to login without a private key

On my VPS, running Debian 7, I have ssh enabled on the default port 22 with only private key authentication enabled, all other ports are filtered with iptables. I am frequently getting login attempts ...
3
votes
2answers
118 views

Mongo Sharding - Config Server and Mongo Authentication

I am needing to shard a database fairly soon, and am unclear on what the best practice is for enabling authentication on the mongos and config servers. I would like to have everything be secured with ...
5
votes
1answer
72 views

Preventing a Domain Computer from Logging off Causes loss of Authentication

I have a set a domain computer to not require a password on wakeup. This is a strange situation I know but we want the user to never have to login to the computer unless he specifically logs out or ...
1
vote
1answer
72 views

How to secure a single file download over HTTP on IIS?

I want to create a download link to a file on my HTTP server (IIS 7.5), for a one time secure download purpose. I don't want the file to be publicly available, the receiver must authenticate. When ...
0
votes
0answers
29 views

Securing files on IIS 7 and Windows Server 2008 Server

What's the best practice for securing a file on an IIS 7 web application running on Windows 2008 server? I have the following requirements and ideas: Requirements: A authenticated user to my web app ...
1
vote
1answer
40 views

How to setup NT Challenge on Windows 2008 R2

I want to setup NT Challenge for a web application. I have read a lot of articles but still not clear how can I setup it on windows server R2. Could anyone please point me settings/Configurations to ...
0
votes
1answer
298 views

Converting the ssh key

to clone my bitbucket project,I changed the /.ssh/authorized_keys content by adding my bitbucket key and I am able to clone into my bitbucket,but after that I was not able to access my server at EC2 ...
2
votes
1answer
122 views

Does Practical NFS Authentication for RPCSEC_GSS Exist Other Than Kerberos?

Most of the reading I have done suggests that RPCSEC_GSS can be set up using Kerberos, but we don't already have a Kerberos server set up. I had read there were other auth methods like LIPKEY that ...
-1
votes
2answers
543 views

Protect access to static files with Apache & Session [closed]

/assets - file1.mp3 - file2.mp3 ... - fileX.mp3 (millions of files) So what I want to prevent is to access the content directly if the user is not logged in like ...
1
vote
2answers
73 views

Securing a remote LAMP server that uses Capistrano for Git deploys

I am deploying my Github repo to a Media Temple Grid Server using Capistrano. In order to do this, I've setup the following: Enabled logging into the remote server with SSH keys (following this ...
1
vote
0answers
57 views

require client certificates in IIS without requiring SSL

In IIS 7, I've created an https binding for a site, and I'd like to require client certificates for https and still keep my http endpoint. That is to say, I'd like to require client certificates for ...
2
votes
1answer
37 views

How to handle user accounts for many sites running on same server

Background to this question: I want to host multiple e-commerce sites on the same server, each with their own separate customer login application. Each site's login application needs to be secured by ...
0
votes
2answers
264 views

Google 2 factor authentication on Ec2?

I have set up google two factor authentication on my local machine. So when I do : ssh localhost I need to verify the code along with password. But when I try to connect to my Ec2 instance like so ...
0
votes
1answer
249 views

sshd_config versus authorized_keys command parameter

Background: I added OTP token authentication to my web server. I modified the /etc/ssh/sshd_config file with the ForceCommand /token/script command. Problem: I have a local Jenkins instance ...
0
votes
0answers
28 views

Cannot log in to SQL 2012 - no known login [duplicate]

Possible Duplicate: How to recover a MSSQL user's password? We recently installed SQL 2012 on one of our servers, but have been unable to log in. Another tech did the installation so I ...
0
votes
3answers
651 views

Purpose of the x509 certificate in metadata files on the IdP side (SSO structure)

In order to implement SSO, I have been working with some IdP and a Shibboleth SP install without being able to answer this question. On the IdP side I have a few metadata files that describes some ...
3
votes
4answers
1k views

OTP vs certificate based tokens

I'm currently in the process of researching options for a two-factor authentication system for our company. I'm currently investigating the pros/cons of certificate-based tokens vs. one-time-password ...
0
votes
2answers
842 views

How to allow just one user to login in special computer in Server 2003

I want to just allow one user to login to a special computer in domain. how can i do that ?
0
votes
1answer
165 views

Is this considered 2 Factor Authentication?

Trying to create a 2 Factor Authentication for users to access data remotely. Here my scenario: We have a Watchguard to VPN into the network - If we use it's internal DB to store authentication ...
6
votes
3answers
2k views

Managing service passwords with Puppet

I'm setting up my Bacula configuration in Puppet. One thing I want to do is ensure that each password field is different. My current thought is to hash the hostname with a secret value that would ...
6
votes
2answers
3k views

How to allow RDP access based on client certificate

How can I limit (RDP) access to a Windows Server not only by username/password but also with a client certificate? Imagine creating a certificate and copying this to all computers from which I want ...
13
votes
2answers
21k views

Troubleshooting Windows Authentication problems (no challenge) in IIS 7.5?

I know that there are thousands of reports of people having trouble getting Integrated Windows Authentication to work with IIS, but they all seem to lead to web pages that don't apply or solutions ...
34
votes
9answers
8k views

Why is SSH password authentication a security risk?

Most guides for OpenSSH configuration advise to disable password authentication in favor of key-based authentication. But in my opinion password authentication has a significant advantage: an ability ...
1
vote
1answer
43 views

How can I determine which users are authenticating via ftp or telnet?

I've inherited a system that has both telnet and ftp enabled. As both these send passwords in cleartext I want to disable them. But many users have never changed their ways to use sftp or ssh. And ...
3
votes
2answers
395 views

Are SSL Client Certificates well supported by all major browsers?

We're thinking of improving the authentication of some critical webpages with client certificates, but we're not sure whether it's a widely used standard. Are SSL Client Certificates well supported ...
5
votes
2answers
2k views

Network authentication + roaming home directory - which technology should I look into using?

I'm looking into software which provides a user with a single identity across multiple computers. That is, a user should have the same permissions on each computer, and the user should have access to ...
2
votes
2answers
80 views

How to structure the “authentication graph” of a group of frontend/backend servers?

I'm taking over a bunch of servers as a newbie sysadmin, which include a frontend web server, and several backend servers that hold databases that include private information of the users of the web ...
1
vote
1answer
85 views

Staging and Development Server Accessibility Restrictions

I have some staging and development web servers on cloud hosting. I do not want them to be accessible to the general public. It's easy enough to restrict access by network or authentication. The ...
0
votes
0answers
186 views

Jira: Handling multiple LDAP Organizational Units in 4.3

I'm in the process of upgrading my company's Jira instance to the latest version 4.3.4. In previous versions of Jira we've been able to intergrate with LDAP just fine, by using a baseDN in the ...
1
vote
3answers
787 views

Break-in attempts on Ubuntu VPS box [duplicate]

Possible Duplicates: Is it normal to get hundreds of break-in attempts per day? What should I do if I find someone is brute forcing my server password? I have an Ubuntu 10.04 VPS box. ...
6
votes
3answers
6k views

How to disabled password authentication for specific users in SSHD

I have read several posts regarding restricting ALL users to Key authentication ONLY, however I want to force only a single user (svn) onto Key auth only, the rest can be key or password. I read How ...
0
votes
1answer
465 views

Multi-factor authenication at ec2 and in general

I noticed aws has multi-factory authentication: http://aws.amazon.com/mfa/faqs/#How_does_AWS_MFA_work This seems to be only for when you login via the web into the web console etc. In general, could ...
2
votes
2answers
2k views

How to configure client certificate authentication in IIS

For me it is trivial to configure Tomcat for client authentication. But trying it to do it in an IIS 7 server (running in Win2008R2 Server) it seems imposible. In tomcat all I have to do is configure ...
1
vote
2answers
185 views

information about windows Basic Authentication

i've some questions about Basic Authentication in Windows Server 2008. I read that Basic Authentication send the passowrd as plain text, so it is insecure, but you can combinate it with SSL to ...
1
vote
1answer
479 views

Is giving read permissions on /etc/shadow to apache user a wise decision from security point of view?

I have to use PAM authentication for DAV SVN, but when everything is configured as specified in mod_auth_pam documentation, authentication does not work. After some research I realized, that for this ...
0
votes
0answers
117 views

What techniques are recommended to prevent a MITM attack when using a public/private key pairs (RSA)?

I currently have a group of web-services exposing interfaces to a variety of different client types and roles. Authentication is handled through a public/private key pairs (RSA) only to verify the URL ...
1
vote
3answers
605 views

What techniques are recommended to prevent a MITM attack when using a public/private key pairs (RSA)?

I currently have a group of web-services exposing interfaces to a variety of different client types and roles. Authentication is handled through a public/private key pairs (RSA) only to verify the URL ...
2
votes
2answers
558 views

How to configure mercurial access controls using apache and hgweb?

I have set up a mercurial repo to be served using apache+wsgi+hgweb on OS X. It is now completely open to anyone who stumbles upon my server on the correct port number.. How can I set it up so that ...
0
votes
1answer
337 views

How to implement strong authentication for OUTLOOK “Client”?

I’ve got a customer that is currently using Lotus Notes, and they’ll be migrating off Notes to Exchange + Outlook (for the email/messaging part) and SharePoint 2010 (for the documentation repository ...
4
votes
5answers
1k views

Two Factor Authentication on EC2

I need to host stuff for a financial institution on EC2. The bank wants complete Two Factor Authentication so Stuff like having SSH with a key with password. Something like SecureID or similar would ...
0
votes
1answer
329 views

Setting up Shibboleth to secure part of a website

I've installed the Shibboleth module for apache on Ubuntu 10.04 using aptitude to install libapache2-mod-shib2 as per ...
0
votes
2answers
806 views

How to control remote access to Sonicwall VPN beyond passwords?

I have a SonicWall TZ-210. I want an extremely easy way to limit external remote access to the VPN beyond just username and password, but I do not wish to buy/deploy a OTP appliance because that is ...
1
vote
2answers
1k views

Unable to set NTFS permissions for ApplicationPoolIdentity on Windows 2008 SP2

On Windows 2008 R2 I am able to set NTFS permissions for an application pool's synthesised ApplicationPoolIdentity account thus: ICACLS d:\websites\site1\www /grant "IIS AppPool\site1":(CI)(OI)(M) ...
8
votes
2answers
3k views

Is SSH Key Exchange more secure than password authentication?

Remote users connect to several services at our main office over the internet using SSH. The SSH password is synchronized with their LAN A/D account. Would having users bring a copy of an SSH key ...
0
votes
1answer
434 views

PAM cracklib vs login.defs

If there are different parameters set for minimum password length in pam_cracklib and login.defs. Which takes precedence ? Any good docs/books about PAM ?
11
votes
2answers
2k views

The Story of secure user-authentication in squid

once upon a time, there was a beautiful warm virtual-jungle in south america, and a squid server lived there. here is an perceptual image of the network: <the Internet> ...
0
votes
3answers
2k views

How do I disable Windows authentication on a SQL Server instance?

How do I disable Windows authentication on a SQL Server instance?
1
vote
3answers
69 views

Picking up a lot of failed authentications for various accounts

My server is getting a lot of various failed authentication attempts for various accounts. The most common one (that I've seen ) or the root account. I have since enabled Fail2Ban and ran several ...