1
vote
0answers
31 views

Hardening Windows Server 2012 r2 for production [on hold]

We have some Windows Server 2012 R2 boxes which will be going into production in the next few weeks. Our security guy is telling us to harden the boxes before we do. I am just wondering what people ...
0
votes
1answer
30 views

Restricting access using IP address / Network Redirection?

I have a situation where we have a web server (lets call it A) that is hosting a set of HTTP based services. Due to some client requirements, this web server is not open to the outside world but ...
0
votes
0answers
23 views

Which modules can be disabled in apache2.4 on windows

I have an Apache 2.4 webserver running on Windows. I am looking into system hardening and the config file httpd.conf. There are numerous load modules and I am wondering which modules I can safely ...
0
votes
1answer
79 views

IIS Webserver hosting intranet and public sites in DMZ

We have a webserver (VM) hosting several sites. One of the applications has a part intranet and a part public. (archiving/docflow = intranet, customer invoices = public) This webserver is currently ...
-1
votes
1answer
54 views

Helpful linux command for do some forensic on compromised linux web server [duplicate]

What are helpful linux command for do some forensic on compromised linux web server for giving out sort of information/evidence/backtrace? for example checking log, checking last file edit, suspicious ...
3
votes
1answer
92 views

Apache upgrade strategy

I'm on CentOS 6.5 and Apache 2.2.15. I wanted my httpd to be up to date so I did: yum update httpd After that it is still version 2.2.15, but latest version is 2.2.22. I also see security updates ...
0
votes
1answer
86 views

Lean but effective linux IDS / IPS / WAF? [closed]

I'm looking for a lean but effective IDS/IDP/WAF solution for my tiny VPS webserver. Currently I already use iptables and psad but a lot of the web server scanning attempts slip through. I use ngingx ...
0
votes
1answer
55 views

Changing file permissions on web server to follow Least Privilege Security Principle: chmod 750 -R /

I'm not sure what details are relevant, but here is some general context. I'm configuring a Ubuntu 12.04 web server on AWS to process customer payment info before redirecting them to a hosted ...
-1
votes
3answers
255 views

How to fight request spam (DDOS i guess) on CentOS server [duplicate]

lately i'm trying to fight DDOS on my CentOS 6.4 server. I have installed CSF and I've set it quite strictly. Yet there is a URL that have like 1000 requests and max 2 per IP (smart ddos-er I guess). ...
1
vote
3answers
78 views

Advice on root account and ports ubuntu server

I've recently launched a website that's only been online 2 days, just checked the auth.log and already there are multiple login attempts being made from an IP based in Asia. I've changed my own user ...
0
votes
1answer
60 views

Securing nginx (user/file permissions)?

I'm just setting up nginx on my web server, and I created a user account for it to use (nginx). However, it runs its worker processes by default as www-data. Is there any disadvantage to using ...
0
votes
1answer
228 views

Hardening CentOS 6 web server security [duplicate]

There is a web server installed as a virtual machine in the cloud. I've configured it myself, and it has two corporate web sites on it. I'am not planning anything else to be there. So before it goes ...
2
votes
1answer
91 views

Duplicate GET request from multiple IPs - can anyone explain this?

We've seen a pattern in our webserver access logs which we're having problem explaining. A GET request appears in the access log which is a legitimate, but private, url as part of normal e-commerce ...
1
vote
1answer
370 views

Errors whilst installing kolab

i'm struggling for the past 2 days please help me anyone... [root@mail /]# setup-kolab Please supply a password for the LDAP administrator user 'admin', used to login to the graphical console of 389 ...
2
votes
2answers
791 views

How do I protect an Apache (in LAMP) install against the Apache Linux/Cdorked.A backdoor?

Just like the title asks, what can I do to protect against infection by the Apache Linux/Cdorked.A backdoor?
0
votes
1answer
78 views

Tomcat vulnerability patching

I had a tomcat vulnerability scan in my linux server and report came as Important: Authentication bypass and information disclosure (CVE-2011-3190) .My apache tomcat is of version 6.0.24. tomcat ...
4
votes
1answer
53 views

What is this user name for and how did it get created?

When I created a website named Portal on my IIS 7.5 on the website permissions->security I got this user. What is its purpose? From what I have read the ApplicationPool runs under NetworkService ...
1
vote
1answer
96 views

Is opening port 80 for basic websites ok?

I have set up IIS 7.5 with some web applications, that are meant for internal use as well as for some of our customers. The information inside them is important to some extent, but not like credit ...
0
votes
1answer
152 views

Mounting /home as noexec [closed]

Does mounting /home with noexec really add security? All it does is disable binary execution right? So that means other scripts can still run and execute shell code into services. Run shared ...
16
votes
5answers
1k views

What are the “to-do” on protecting Windows server facing the web?

I currently begin to deploy Windows servers facing the web. And I would like to know what are you way of protecting your servers ? What softwares are you using ? On Linux, i'm using Fail2ban to ...
1
vote
1answer
91 views

Which user account should I use for an intranet web-app service?

I've written a web-application to run on Windows (XP,7,2008, etc), not using MS tools (python/django/nginx, though it should not matter). To run the app I've created a Windows Service which installs ...
-1
votes
1answer
114 views

Where websites should live on a Linux server [duplicate]

Possible Duplicate: Should websites live in /var/ or /usr/ according to recommended usage? On a Linux server, sites are typically stored in /var/www. But recently I got to know that ...
1
vote
3answers
154 views

What consequences to take from what i read in logfiles?

Since some weeks i manage my first Webserver, a Seaside application behind an Apache proxy on Linode, and i installed logwatch to send me daily logs. Where can i get information on when i have to act ...
1
vote
1answer
594 views

Protecting Apache and Nginx against slow read/write and similar attacks?

There are many articles explaining many ways to attack webservers (generic or specific) and even listing general rules for mitigating such attacks, e.g.: Do not accept connections with abnormally ...
4
votes
3answers
181 views

Is there a downside to enforcing 128bit SSL for a website

On Windows Server 2008 R2 I can enforce 128bit SSL for a website by executing: appcmd set config "Default Web Site" -section:access -sslFlags:Ssl,Ssl128 -commit:apphost Is there a downside to that? ...
3
votes
1answer
160 views

running arbitrary, encrypted shell commands via http(s)?

I'd like to be able to encode maintenance scripts to run on-demand remotely. edit: Good use-case: webhooks. e.g. trigger CI + staging deployment whenever someone pushes code to github. If I was to ...
-3
votes
1answer
119 views

Protecting a chmodded 0777 cache directory?

A website I'm developing requires several directories to have their permissions set to 0777. The directories are used as cache directories for HTML and PHP files generated by the website. The ...
1
vote
0answers
268 views

How to set linux permissions to allow Apache to have access to a file [closed]

Linux noobie here, I'm still figuring things out as I move along. At my school we have a shared server environment where every student gets an account. But we have very limited permissions. I have a ...
-1
votes
1answer
196 views

what are the must have applications for an intermediate devop? [closed]

Over the past year my responsibilities have grown from managing 5 servers to 20+. Most all of these are either on EC2 or Linode and they all serve different purposes. Some are on CentOS and others on ...
1
vote
1answer
31 views

How to fix libxml2 vulneribilty

I am using ubuntu 12.04, as per ubuntu http://www.ubuntu.com/usn/usn-1447-1/ libxml2 needs to be patched, how can i achieve it without distro upgrade
1
vote
3answers
1k views

How to drop all requests using mod_security

I have an apache2 server with several sites enabled on it, including the default one (000default). The default server is catching lots of spammy requests that are doing nothing but consume bandwidth ...
0
votes
2answers
49 views

Safely Execute Stored Procedure Via DMZ Server

I'd like to execute a stored procedure via web application that connects to SQL Server. The procedure is to be activated by clicking a link in an email. The link will have to be accessible from a ...
0
votes
1answer
99 views

Securing Erlang / Ubuntu server

I have written a web service in Erlang using mochiweb and jiffy and now face the task of deploying it to production. Since it is going to be open to the public I was wondering how secure Erlang ...
1
vote
1answer
4k views

Apache httpd: Send error logs to syslog and local disk? Without touching /etc/syslog.conf?

I have an Apache httpd 2.2 server. I want to log all messages using syslog, so that the requests are sent to our central syslog server. I also want to ensure that all log messages are sent to local ...
0
votes
1answer
213 views

Http server security analyser and sanitizer proxy

I'm looking for software that will monitor all https request coming through our proxy server. We currently use nginx that proxies to our application servers. Ideally, the solution will sit between ...
2
votes
1answer
1k views

Where I can find ModSecurity Rules for Specific Applications

Where I can find ModSecurity Rules for Specific Applications specially joomla, wordpress, mambo ?
1
vote
1answer
296 views

Block illegitimate traffic (hackers, scrapers, spammers) to your website

According to a recent report from ZDNet, 31% of traffic is illegitimate (hackers, scrapers, spammers). The challenge as a sysadmin is to find a way to block that traffic without blocking your real ...
0
votes
1answer
1k views

How to make sure www directory is secure?

I managed to order a new VPS account from linode I have installed Ubuntu 10.04 LTS with 'LAMP Stack' StackScript. I notice the website directory is located in /srv/www/ and I thought this is quite ...
2
votes
0answers
38 views

Tomcat security without a Web Server [closed]

Can anyone tell me, from his experience, if is a good approach leaving Tomcat alone (in PRD) and not "hidden" behind a real web server as Apache or IIS? The application I am deplying on Tomcat is an ...
-1
votes
1answer
348 views

Need python script for vulnerability assessment? [closed]

How to scan my server remotely? I want to scan a website, so my server, and gathered information related to webserver and other software associated info. I got one named blindelephant . But it is not ...
1
vote
1answer
139 views

Can one rely on Apache sanitizing URLs?

I set up Apache with mod_wsgi in a default installation, with a very simple test application test.wsgi that goes like this: def application(environ, start_response): status = '200 OK' output ...
1
vote
1answer
89 views

Securing php webserver from exploits? [closed]

We are running a PHP application on a linux apache webserver. How can we secure the server, so if someone finds a hole in our application, they can only get access to the application (Files inside ...
73
votes
4answers
45k views

What permissions should my website files/folders have on a Linux webserver?

This is a Canonical Question about File Permissions on a Linux web server. I have a Linux web server running Apache2 that hosts several websites. Each website has its own folder in /var/www/. ...
2
votes
2answers
183 views

CentOS webroot Owner

I'm working with a dedicated CentOS server where the base exposed webdirectory is /var/www/html For security, who should own the html directory "root" or "apache"? The perms are drwxrwxr-x (are ...
1
vote
1answer
62 views

What is the best way to authenticate only certain computers/devices on a network for a web server?

Currently I'm trying to use Windows Firewall service and select 'only these accounts'...but that isn't working. Normal access to file shares works by selecting said accounts but not to the web server ...
0
votes
2answers
1k views

Analyzing Apache access logs to quickly identify abuse

So someone in China just loves abusing the crap out of my networking tools site up at yougetsignal.com. I've been trying to analyze my access.log files to see exactly what they are so excited about. ...
5
votes
2answers
148 views

DDoS attack case study - Korean election watchdog's site [closed]

Is it possible to break only some of a web site services using DDoS? For example, disabling only the search feature of a specific website. I raise this question following a controversy in South ...
1
vote
3answers
459 views

Free security audit tool for LAMP server? [closed]

I've a dedicated LAMP server (Ubuntu) with several Drupal and Wordpress installations on it. Is there a free CVE compatible tool, which could scan my server with all websites and generate automatic ...
2
votes
1answer
791 views

Hide/Replace Nginx Location Header?

I am trying to pass a PCI compliance test, and I'm getting a single "high risk vulnerability". The problem is described as: Information on the machine which a web server is located is sometimes ...
1
vote
1answer
98 views

Why would someone be doing a GETfor mail.live.com against my domain?

Just today I've started to see in my web-server logs lines like this: IP_WITHHELD - - [19/Oct/2011:20:47:04 +0000] "GET /providers/bookings HTTP/1.1" 500 21975 ...