1
vote
1answer
26 views

How do I find what PHP script is changing the file

I have apache installed with mod_php PHP5. I've been able to find out that apache process is changing my .htaccess and index.php files in /var/www directory. All files in this directory are owned by ...
0
votes
0answers
20 views

How to remove malware from Debian server? [duplicate]

We have one Debian server that is affected by a malware. It's adding some code to the .htaccess files in /var/www directory where all sites are stored. Here's the malicious code: RewriteEngine on ...
1
vote
1answer
40 views

iptables connection limit does not work on debian

I'm trying to set up some basic DOS protection. The following iptables rule works on a CentOS box but NOT on debian (wheezy). #limit the parallel http requests to 50 per class C sized network ...
-2
votes
1answer
25 views

Allow outgoing connections for DNS [closed]

I'm new to IPtables, but I am trying to setup a secure server to host a website and allow SSH. This is what I have so far: #!/bin/sh i=/sbin/iptables # Flush all rules $i -F $i -X # Setup default ...
0
votes
2answers
33 views

IPtables - Sensible and non-contradictory rules?

This is my IPtable rules for my webserver with SSH installed, i've had help to get this far. My question is, are my rules contradictory. For example, I've been recommended to use these two lines: # ...
4
votes
3answers
179 views

IPtables locking down website allowing only SSH

I have written my first IPtables rule file to try and protect my server on all ports apart from SSH and the ports needed for the web. This is what I have come up with: i=/sbin/iptables # Flush all ...
1
vote
4answers
62 views

Securing debain with fail2ban or iptables

I'm looking to secure my server. Initially my first thought was to use iptables but then I also learnt about Fail2ban. I understand that Fail2ban is based on iptables, but it has the advantages of ...
-1
votes
1answer
160 views

RKHunter reported processes that are using deleted files or are listening on the network

I ran Rootkit Hunter 1.4.0 on a Debian Wheezy server and I am confused by the output. I enabled every tests using the following piece of configuration: ENABLE_TESTS="all" DISABLE_TESTS="none" The ...
1
vote
1answer
67 views

Correct Permissions VPS /var/www

This is a repost of an "off-topic" question on stackoverflow. My scenario is: I created a user and added that user to sudoers: visudo user ALL=(ALL) ALL Then sudo adduser user www-data and ...
0
votes
1answer
101 views

How to check if an apt mirror has the version of package I required?

Let say I want to query if openssl, 1.0.1-4ubuntu5.12 is available in the mirror, e.g. deb http://security.ubuntu.com/ubuntu precise-security main restricted Any easy command I can check?
1
vote
1answer
26 views

is this normal behavior for pam_tty_audit

I've recently configured pam_tty_audit, and while it does log information, it seems like it does not log information until after the user has logged out. Oddly enough, it does log some things live, ...
0
votes
2answers
36 views

Security Help? Is this a safe way of doing things?

I am running Apache with Debian. At the moment to share my site I am just setting up my router to foward my local ip on port 80. So anyone who wanted to look at my site can just type in my router's ...
1
vote
1answer
76 views

Secure installation of KVM VPS?

I'm going to install Debian Wheezy on a KVM VPS. VNC access to console is enabled, and by sniffing network traffic when connecting, I see VNC password is encrypted but everything else is sent in plain ...
0
votes
0answers
89 views

Chroot master process Nginx 1.2.1

I want to install nginx not current stable version but in one currently deposits, and chroot the process. I followed some tutorials including: Securing Debian Manual Appendix H - Chroot environment ...
1
vote
1answer
49 views

Logging in iptables

I have created rules in iptables to log and edited the rsyslog.conf file to output any message which contains "iptables" to a different log file. It seems that it is logging to both places, the ...
1
vote
2answers
112 views

Will debian update packages that I've personally build from their official sources?

Hi and happy new year to you all.. Recently I've built nginx deb package v1.4.4 from debian backport source that of course I've added to the apt sources.list and things went great. My question: ...
1
vote
1answer
103 views

Why is PHP open_basedir not considered a security model

On servers doing shared web hosting, or sharing the PHP environment between different PHP applications, I usually implement a security policy that uses PHP open_basedir to restrict each user to ...
1
vote
0answers
62 views

What are recommended permissions for files in /var/log?

I am working on tightening the security for various servers (mainly Debian Linux), and one of the tasks is to tighten permissions on files in /var/log so that files are not world readable. But there ...
-1
votes
1answer
142 views

Debian server hacked [duplicate]

I just discovered my debian server has been hacked. I noticed when I did apt-get update, it failed because /var/log/apt directory did not exist. I investigated and found the following: Almost all ...
3
votes
3answers
205 views

Logging when limit Exceeds

Is there a log file that logs information when the values set in /etc/security/limits.conf are exceeded? If the values are too tight in the above file the clients using the website hosted on the ...
1
vote
1answer
80 views

How does fastCGI PHP alter a file and escape detection by auditd?

The other day I set up a little shell script on a Debian server to send me an email when files change; it looks like this: #!/bin/sh items=`find /var/www/vhosts -regex ".*/httpdocs/.*" -newer ...
2
votes
1answer
59 views

How to securely connect to multiple different LDAPS servers (Debian)

I'm trying to connect to multiple different LDAPS servers. A lot of the documentation I've seen recommends setting TLS_REQCERT never, but that strikes me as horribly unsecure to not verify the ...
-1
votes
1answer
112 views

how is possible to become root without having the password and only a ssh login?

I am having a problem, I have one server, I have my root account, but some other co worker has an ssh login, still... I have no so much experience and I dont know what I could do to block him to ...
0
votes
2answers
303 views

Securing dnsmasq - interface(s)?

Im preparing to deploy about a thousand fanless machines running Debian. Each machine has 3 interfaces (eth0, eth1 and uap0). In many cases these machines will sit between a cable modem and a home ...
0
votes
3answers
66 views

watch file to see whos accessing/writing it and log it

I am facing some malware problems on my webserver. I updated third party software such as Wordpress to the latest version, disabled root logins and my users password complex enough but still someone ...
0
votes
1answer
110 views

debsecan won't launch on debian wheezy

I've insalled the package debsecan in debian wheezy with 3.7.1 kernel. when I try to run it it gives me this output: error: while downloading ...
11
votes
2answers
498 views

What to do when someone logged as root on my server

I have a server running Debian 6.0 with logcheck installed. Yesterday ago, I received this message: Jan 19 19:15:10 hostname sshd[28397]: Authentication tried for root with correct key but not from a ...
5
votes
1answer
105 views

Ubuntu to list relevant security advisories

If I want to find out what security updates there are on a redhat/centos server and the coresponding security advisory I can run this command: yum --security list-security That would include data ...
1
vote
2answers
349 views

how can a mirror all of the traffic on a network interface, to virtual interface

I am trying to setup snort to act as an ids, on a debian machine that also functions as a router. Ideally I would like to setup snort in such a way so that I would not have to purchase an additional ...
2
votes
2answers
2k views

OpenVPN bad source address from client

I have one problem with OpenVPN. There are a lot drops records in the openvpn log file on the server: Mon Oct 22 10:14:41 2012 us=726541 laptop/ххх:1194 MULTI: bad source address from client ...
4
votes
2answers
1k views

Disabling the shell of user “daemon” (/bin/false)

on a Linux system there are lot's of users by default: daemon, bin, sys, games, etc. According to my /etc/passwd most of these users have a shell assigned (/bin/sh) which seems some kind of insecure ...
0
votes
1answer
45 views

PHP Requests Being Blocked After Making About 25 in Ten Minutes

We have an administrative portal where we run PHP functions through a JavaScript portal using Ajax for administrative purposes. For example, we might have a function called updateAllDatabaseEntries() ...
3
votes
1answer
99 views

Security issue with ssh on Debian server

I have setup Debian Squeeze on an old laptop to serve as a testbed. I have installed OpenSSH and edited /etc/ssh/sshd_config to use ssh keys and disallow password authentication. I am able, however, ...
0
votes
2answers
2k views

Restricting User Access in Debian Squeeze

I've been contemplating ways to restrict user access to their own directories, not allowing them to navigate above their own user directory. I'm using SFTP, and don't want to install regular FTP ...
-1
votes
1answer
50 views

Installing and setting up an IMAP server? [closed]

I want to set up an IMAP server on my vServer. I googled for some servers, and I've already found some like dovecot etc. I would like to know which one is the most secure one, and which one you ...
1
vote
1answer
162 views

TCP forwarding over SSH with socat or any other tcp forwarder, on sshd with tcp forwarding disabled

What I am trying to do is have a user that can port forward, but only to a certain host and port. I've disabled TCP forwarding over ssh for that user, and according to the manpage for sshd_config I ...
5
votes
3answers
1k views

how to limit the number of simultaneous processes per user in the system?

yep, i know that question was asked many times, but unfortunately i didn't find the complete answer on it. so, how to limit the number of simultaneous processes per user? i found two solutions: ...
0
votes
1answer
116 views

Weird Apache Error Log [duplicate]

Possible Duplicate: What are these weird access requests? [Thu May 03 11:39:36 2012] [error] [client 200.159.40.31] File does not exist: /var/www/w00tw00t.at.blackhats.romanian.anti-sec:) ...
-1
votes
2answers
534 views

Linux Debian Security Breach - what now? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I installed Debian (Squeeze) a while back in my home network to host some personal sites (thank god). During the installation it ...
1
vote
1answer
473 views

Can someone explain this rkhunter report?

This is my rkhunter output that I recently set so I get this report every morning, could somone please explain if I have a serious problem here (I know about httpd, openssl, php and sshd not up to ...
4
votes
4answers
398 views

Upgrading multiple Debian servers at once

I'm currently working at a SaaS company, and at the moment we have multiple Debian servers running in our data centre to support our application. In the past, when a security update was released, we ...
-1
votes
1answer
347 views

Keep or remove nscd?

Updated question: Assuming the setup of a "minimal" web server (apache2, php) - e.g. with the least features possible - I would like to know if the nscd is truly required for optimal functioning of ...
2
votes
4answers
5k views

nmap on my webserver shows TCP ports 554 and 7070 open

I have a webserver that hosts various websites for me. The two services that are accessible outside are SSH and Apache2. These are running on a non-standard and standard port, respectively. All other ...
0
votes
1answer
132 views

Ready-to-use kvm server-images for Rails-Apps?

I'm taking care of some Rails-Deployments. For this I use several KVM virtual machines like this: Apache Load-Balancer (mod_proxy) & HTTPS-Gateway foreach rails-app { Rails-Server ...
0
votes
1answer
144 views

Fail2ban Custom Port

I have a rule like this in my jail.local file: [ssh-ddos] enabled = true port = ssh,sftp filter = sshd-ddos logpath = /var/log/messages maxretry = 4 If I want to use a custom port for SSH, ...
1
vote
1answer
1k views

How to monitor file/directory changes

I have a Server running Debian Lenny. Recently I've encountered a few security issues. I am specifically seeing a file get created within /etc/php5/conf.d named 'php-dev.ini'. At first glance the ...
10
votes
2answers
854 views

Does Debian 6.0 (Squeeze) have buffer overflow protection mechanisms?

My question is: Which buffer overflow / stack smashing defenses (if any) are enabled by default in Debian 6.0 (Squeeze)? Ubuntu has a handy summary table showing the main security features of each ...
2
votes
1answer
173 views

Is a firewall really necessary? [duplicate]

Possible Duplicates: Why should I firewall servers? Why would I need a firewall if my server is well configured? For a single web server that only listens on 22/80/443, is a firewall ...
0
votes
1answer
1k views

Enabling remote access to mysql on debian

I need to enable remote access for a specific user on a mysql server, running debian oldstable. Bear in mind I'm no SQL expert nor a real sysadmin. Logging in phpmyadmin and looking at the ...
1
vote
1answer
142 views

fail2ban on Ubuntu (defaults okay?)

I run an Ubuntu-based web-server (LAMP) and have installed fail2ban. Does it have sensible defaults to restrict malicious activity via SSH and any LAMP ports out-of-the-box? Or, does it need to be ...