0
votes
1answer
36 views

How to block server's internet access and only allow LAN [closed]

I was wondering what the best way to block a server's internet access is while allowing LAN connections. Essentially, I want a server to be only accessible by LAN. What ips, ports, etc should I block? ...
0
votes
1answer
94 views

I think my server was hacked - how do i know what has been changed? [duplicate]

I have read the following posts which didn't answered my questions: - My linux server was hacked. How do I find out how and when it was done? - How do I know if my Linux server has been hacked? - and ...
3
votes
2answers
111 views

Use of rpm and yum for application installation in large installation environment

Our very large organization has developed a standard for hosting of applications which dictates that the application and all components on which it relies must reside in a dedicated application volume ...
-3
votes
1answer
49 views

Keeping your server safe [closed]

I have a typical vps server with some custom sites on it running on port 80, a mail server, I don't have a DNS server and it is a default ubuntu 12.04. I don't have any admin panel, I am doing all the ...
0
votes
0answers
38 views

Reverse a command and disable su on Ubuntu

Whilst following an online guide on how to secure Ubuntu server, I ran this command on one of my test VM's. sudo dpkg-statoverride --update --add root admin 4750 /bin/su I know the intention of ...
1
vote
8answers
195 views

Can I (practically) block access to the SSH port to my country only?

I'm thinking that blocking access to the SSH port to allow for my country only is an obvious step, but I can't see a practical way to do this. I'm in the UK if it matters. I have full access to the ...
0
votes
2answers
75 views

Should munin be password-protected?

We use Munin at work. There is a Munin install - which right now is open to the world. An admin doesn't think he needs to password-protect it. What's the worst that can happen? How can I convince ...
2
votes
2answers
115 views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
1
vote
3answers
145 views

Open SSL - Is my ubuntu really secure now after dist-upgrade?

I am running a Ubuntu 12.04 server and I just updated the server with (and rebooted afterwards) sudo apt-get dist-upgrade Now the open SSL version sais, it is build on 7 Apr 2014 what is good, but ...
1
vote
1answer
127 views

unable to switch off expose_php in ubuntu 14.04 with nginx and php-fpm

According to phpinfo: Loaded Configuration File: /etc/php5/fpm/php.ini # grep expose_php /etc/php5/fpm -R /etc/php5/fpm/php.ini:expose_php = Off ...
0
votes
0answers
58 views

Hardening of ubuntu server.How to prevent overkill checks? How to detect genuine request from attacks?

I have followed one these hardening check list tutorials where I have noticed that there fail2ban installed and denyhost at the same time. To my knowledge fail2ban does a little more than what ...
25
votes
8answers
17k views

My server is still vulnerable to heartbleed even after I update OpenSSL

I have an Ubuntu 12.04 server. I have updated the OpenSSL package in order to fix the heartbleed vulnerability. But I am still vulnerable even, even though I have restarted the web server, and even ...
0
votes
1answer
116 views

How to check if an apt mirror has the version of package I required?

Let say I want to query if openssl, 1.0.1-4ubuntu5.12 is available in the mirror, e.g. deb http://security.ubuntu.com/ubuntu precise-security main restricted Any easy command I can check?
72
votes
7answers
27k views

Heartbleed: how to reliably and portably check the OpenSSL version?

I was looking at a reliable and portable way to check the OpenSSL version on GNU/Linux and other systems, so users can easily discover if they should upgrade their SSL because of the Heartbleed bug. ...
0
votes
1answer
29 views

In sysctl.conf settings, what is the difference between 'all' & 'default'?

In context of sysctl.conf settings, what is the difference between (all vs. default) like net.ipv4.conf.all.accept_source_route & net.ipv4.conf.default.accept_source_route in sysctl settings ? ...
0
votes
1answer
153 views

Modifications to sysctl.conf in openVZ container, do they even take effect?

I'm following a security guide(http://www.thefanclub.co.za/how-to/how-secure-ubuntu-1204-lts-server-part-1-basics) to strengthen my OpenVZ based VPS webserver running Ubuntu 12.04 , a part of that ...
1
vote
2answers
48 views

Ubuntu Server 13: How to prevent users from exploring the filesystem with php

I hosting websites for several clients who do not have shell access. How do I prevent these users from exploring the system using PHP? Right now, I'm using suphp to their code as themselves, but ...
1
vote
3answers
314 views

Is this a security breach?

I have a server running Ubuntu 10.04LTS (I know it is too old), which over the last couple of weeks has on occasion been unresponsive to network traffic, and needed a hard reset first thing in the ...
1
vote
1answer
397 views

How to hide Folders for FTP user jailed to user home

Setup: VSFTPD FTP server Only the FTP user has access to FTP User home modded to /var/www User now has write access only to /var/www User still can browse folder structure - this is what i want ...
-2
votes
1answer
576 views

Removing Unnecessary Services & Packages in a MySQL Ubuntu 12.04 Server [duplicate]

As part of hardening a standalone/dedicated MySQL 5.6 server running on Ubuntu 12.04 LTS, unnecessary services and packages will have to be removed. For a server that is serving only as a MySQL ...
1
vote
2answers
415 views

Web server atack DDOS

I have a server (vps) to use as a repository and testing (gitlab and redmine) server. However apache crashed, seeing the /var/log/apache2/error.log have many errors of this type: [Fri Jan 31 ...
0
votes
1answer
125 views

A ghost process started automatically and drains CPU [duplicate]

I am running an Ubuntu virtual machine that has few sites installed on it. I think due to my error and wrong permissions a malicious code was uploaded on the server and the "worm" had root access for ...
1
vote
1answer
62 views

Setting up ufw without locking yourself out

Basically I want to protect a Ubuntu server with a firewall and sided for ufw. The big problem is that I don't have physical access to the server, neither is it possible to force a reboot or revert to ...
3
votes
1answer
85 views

Fail2ban settings after changing ssh port

I switched my ssh port to 22000 and I changed the port settings in /etc/fail2ban/jail.local to specify to ban on both 22 and 22000 but when I tried failing to login 6 times, my connection was cutoff ...
0
votes
0answers
64 views

Apache2 mod_dav_svn SVNListParentPath dependent on cilent IP / subnet?

Hopefully a simple question. Given the following Apache 2.2 VirtualHost configuration on a local network server with access from the local network and the internet: <VirtualHost *:80> ...
1
vote
2answers
157 views

How to secure a new server OS installation [closed]

I bought (and just received) a new 1u dell poweredge 860 (got it on ebay for $35). I finished installing Ubuntu Server (Ubuntu Server 12.04.3 LTS), install apache/mariadb/memcache/php5 works great ...
1
vote
2answers
364 views

Locating Rogue Perl Script

I've been trying to source the location of a perl script which is causing havoc on a server which I control. I'm also trying to find out exactly how this script was installed on the server - my best ...
3
votes
2answers
1k views

Is disabling password login for SSH the same as deleting the password for all users?

I have a cloud server with only a root user. I SSH to it using RSA keys only. To make it more secure, I wanted to disable the password feature. I know that this can be done by editing the ...
2
votes
1answer
134 views

Beast / CRIME / Beach attack and stopping it

I have read so much on all this but not entirely sure I understand what has gone on. Also, is this one, two or three problems? It looks to me like three, but it's all very confusing: Beast CRIME ...
0
votes
2answers
280 views

Trying to set up virtual hosts to block access by IP, for three domains and when using SSL on one domain

So I want all this on one server: - 3 domains / websites - SSL on one of them - nothing to be accessed by an IP address (e.g. 'domain.com' is okay, but not by just typing '123.55.44.123' into the ...
2
votes
1answer
821 views

Why use lxc instead of chroot?

One ubuntu server hosts 3 apps all on separate domains. Each app has its own developers. App developers belong to linux "sftp" group. chroot allows password sftp access for each app developer. ...
0
votes
1answer
41 views

Allow HTTP packet from specific hosts on an ec2 instance strictly

I have an ec2 instance (proxy) which is being used as http proxy server. There are some other hosts (hostA, hostB, hostC), I want the proxy server will only allow connection from those hosts. For ...
1
vote
1answer
113 views

SVN+SSH On Ubuntu: Locking down security - Passwords

Good day, I have setup a server running Ubuntu 12.04 LTS. I have left the default SSH port as-is for now, and have set up a DynDNS.org account. From a machine, running linux, on a separate network, ...
0
votes
2answers
55 views

Understanding Auth Logs on Ubuntu Server [duplicate]

I have a web application that I'm hosting on an Amazon Ubuntu server, and it has a public IP address - and very little traffic. I was observing the authorization logs in /var/log, and noticed several ...
1
vote
2answers
173 views

Ubuntu Apache2 Secure Directory Issue

I have been trying to prevent access to WordPress wp-admin and wp-includes directories on Ubuntu 13.04 with Apache2 2.2.22. First I tried to do this using .htaccess which for some reason wouldn't ...
0
votes
1answer
642 views

Disabled IPV6 but still showing in netstat

newbie here, for security best practice I want to disable IPV6 (not to deal with IPV6 firewall settings). I use Hetzner root server Ubuntu 12.04 . /etc/sysctl.conf file already have a setting from ...
0
votes
1answer
98 views

Securing database server with IPTables

I have my app (WordPress) and database (MySQL) on separate servers; they are connected on a private network provided by the hosting service provider, and I've taken all the preliminary steps (that I ...
1
vote
2answers
55 views

Is it possible to limit access to an svn server to not just credentials but to machines as well?

my office has provided laptops to all staff in addition to the new desktops we just have. I have been asked to secure our svn server which is a dedicated server hosted somewhere with ubuntu running on ...
0
votes
1answer
132 views

fail2ban block retry count always changes

As title mentions clearly, fail2ban block retry count always changes. I set all retry counts to 3; but sometimes it blocks me after 6 or 7 retries. How can set its behavior a constant value? I added ...
0
votes
1answer
62 views

fail2ban doesnt permanently block

Fail2ban doesn't seem to block permanently. I have bantime =-1 but if i look a bit later on my iptables its just not there anymore all ill see is Chain fail2ban-ssh (1 references) target prot ...
1
vote
3answers
80 views

Advice on root account and ports ubuntu server

I've recently launched a website that's only been online 2 days, just checked the auth.log and already there are multiple login attempts being made from an IP based in Asia. I've changed my own user ...
-8
votes
1answer
88 views

LAMP Installation and security [closed]

I installed LAMP server on Ubuntu 13.04 using this tutorial word to word. It worked nicely. But I am hardly able to understand these steps : $ sudo usermod -a -G www-data your_user $ sudo chgrp -R ...
1
vote
1answer
314 views

How to ban web crawler using fail2ban

I am using nginx and I am always hit by web crawler if I am correct. I tried to configure fail2ban but the IP address cannot be detected by fail2ban. The reason that it is not detected because it ...
0
votes
1answer
93 views

file permissions for scripts that need write access

This question helped me quite a bit: What's the best way of handling permissions for apache2's user www-data in /var/www? I would like to take the above question further, I want to be able ...
1
vote
1answer
69 views

Auth.log understand it [duplicate]

I have an ubuntu server and I want to understand if someone enter into it (hacker). I have seen into auth.log many lines like this: May 30 10:36:00 xxx-System-Product_Name CRON[2758]: ...
0
votes
1answer
213 views

How can I configure a Ubuntu LAMP web server with permissions like CPanel?

I know how to set up a LAMP stack on Ubuntu pretty well for a single website / single user, but I'd like to allow multiple users to host multiple sites on a single server. This is for different ...
0
votes
1answer
431 views

Ubuntu Server DDoS protection [duplicate]

I've seen many articles on DDoS protection, but none work. I need protection for a socket server i'm running on the server. It's running on port 9876 and it's for a flash-based game. when it gets ...
0
votes
2answers
187 views

-bash: www.mydomain.com.pem: Permission denied

I have these three files in /etc/nginx/ssl folder: www.mydomain.com.csr www.mydomain.com.key www.midomain.com.key.nopass I bought and downloaded the positive ssl certs in ...
-2
votes
1answer
41 views

More server in a net security [closed]

I have two ubuntu server into my company: 1) backup server which only backup computer or remote server (IP: 192.168.1.253) 2) real server which contains all data file apache where run our demo project ...
0
votes
0answers
58 views

Someone hacked my system [duplicate]

I have two linux server. Another company phoned me that my IP try to connect into their server every 8 seconds. I have a server with a firewall(shorewall) and a server without it. But now I want to ...