Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
0answers
3 views

Can I use same suricata instance for both IDS (for L3,4) and IPS (for L3,L4,L7)?

I have a interface where traffic is flowing from internet to NGINX server to application server. I want to monitor (IDS) the traffic flowing between Internet and NGINX at L3,4 and IPS the traffic ...
2
votes
1answer
42 views

Device not accepting connections from a forwarded port. Security Issue?

I am forwarding a port through to a PLC/Management unit type device for a heatpump. The device accepts local connections from the LAN on port 80. It runs a normal web site on port 80 for management. ...
-4
votes
0answers
36 views

How to fix LogJam vulnerability in Nginx

Could you please post a detailed anser on how to fix LogJam vulnerability in Nginx? A checker can be found here: https://weakdh.org/sysadmin.html Thank you.
9
votes
6answers
506 views

Security Admins toolkit? What's in yours? [closed]

Resource question :- I need to collate a list of security admin tools For: Web Network Wifi Server unix/Linux/windows/macosx SQL Xss Please state -links/version/os used/free v buy
0
votes
1answer
23 views

Windows server 2008 Admin password changes after logout

I have windows server 2008 with two administrator accounts and I have a fixed IP for it. I access the server with remote desktop but every time I logout of any of the 2 admin accounts i can't login ...
1
vote
1answer
984 views

403 forbidden error going through aws load balancer

I am running a IIS 7 Server behind an aws load balancer. I am using a Verisign SSL certificate which is installed properly but whenever I put in the URL, or the DNS name of the load balancer I get a ...
1
vote
1answer
38 views

IPtables drops all, but postfix still send emails

My iptables rules: # delete all current rules and user chains iptables -F iptables -X # global policy (target by default) iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP # ...
39
votes
10answers
10k views

Why is SSH password authentication a security risk?

Most guides for OpenSSH configuration advise to disable password authentication in favor of key-based authentication. But in my opinion password authentication has a significant advantage: an ability ...
2
votes
1answer
44 views

Is a reboot required for SSL V3 disable on Windows? - Poodle exploit

We are trying to disable SSL V3 on numerous windows servers; as a part of it , registries are being updated remotely via script. Problem is lots of reboots are required post registry change. Is there ...
0
votes
1answer
79 views

Security implications of running Apache with php5-fpm as user:user

I just set up VPS to run Apache with php5-fpm which is set to run every user pool as user:user. Reason for this is simply to allow users to actually own their own files created by various CMS ...
1
vote
1answer
30 views

how to block all requests from URLs with MSDOS device name using isapi filter cve 2007-2897

I recently had an audit report on my windows server 2008 R2 and it failed with the error/vulnerability: Microsoft asp.net ms-dos device name DoS www (443/tcp). I have not been able to find any ...
-1
votes
2answers
20 views

Creating Virtual Proxy Server

I know this is not this kind of forum, but I can't find anything in google that really answers my question. Is there possible to create a Proxy server running in a Virtual Machine using only 1 ...
3
votes
4answers
2k views

WMI permissions: Select CommandLine, ProcessId FROM Win32_Process returns no data for CommandLine

I am gathering performance data via WMI and would like to avoid having to use an account in the Administrators group for this purpose. The target machine is running Windows Server 2003 with the latest ...
5
votes
7answers
5k views

Why would you use EAP-TTLS instead of PEAP?

As I understood EAP-TTLS and PEAP share same level of security when implemented in wireless networks. Both only provide server side authentication via certificate. The drawback of EAP-TTLS can be ...
1
vote
1answer
40 views

Automatic unlock bitlocker to go (usb stick) on domain computer

Is there a way to automatically unlock bitlocker encrypted USB sticks on windows computers that are domain joined (8.1 Enterprise)? (e.g., based on the "BitLocker identification Field"?) The scenario ...
0
votes
2answers
3k views

Allow service to interact with desktop

DC OS - Windows Server 2008 R2 Std Client OS - Windows XP, Windows 7 I have implemented Security policy through Network Policy Server and enabled Wired AutoConfig Services Automatically. While ...
0
votes
1answer
892 views

McAfee ePO server not displaying updated Product version number

I have recently been given Administrative rights to help maintain ePO on my companies network. From the group of machines that I am in charge of keeping up-to-date, a small amount of these machines ...
-2
votes
0answers
16 views

UFW deny all outgoing except to certain IP's [duplicate]

I need to secure my server by making sure it can only communicate with a certain set of IP's (both incoming and outgoing). Setting up the incoming rules is easy enough, but I can't seem to find any ...
-3
votes
1answer
87 views

How could this hack have been possible unless the host itself was compromised? [closed]

UPDATE II: I honestly fail to see how my question is inappropriate for this site, and no one seems to want to give me a reasonable response for that, but whatevs, I solved it. Thanks to the actual ...
0
votes
0answers
10 views

Using Node in Conjunction with Nginx for a Secure Web App [closed]

Background I'm trying to set up a as secure as possible website with Node as a backbone instead of the familiar PHP. The Nginx server utilizes TLS 1.2 and serves the client side web application ...
11
votes
7answers
2k views

Preventing theft of data on remotely deployed servers exposed to physical access [closed]

I am trying to think of a way to secure Linux servers that are exposed to physical access. My specific platform are small form factor Linux servers on a PC Engines brand alix2d13 mother board. The ...
0
votes
1answer
14 views

Is is possible to have an Admin account manage both Exchange 2013 (on prem) and Office 365?

We are in hybrid mode and a few people are asking me to create an additional account for them so they can administer O365 and use a different account for on prem exchange. After troubleshooting on my ...
0
votes
0answers
12 views

jenkins security settings on OSX revert on system reboot

I have a headless jenkins box that I have set up in another office. Previously I had installed and used the AD plugin, but something broke and it no longer can authenticate. I have uninstalled and ...
2
votes
2answers
3k views

Windows GPO Software Restrictions Policy not working with %TEMP% variable

I'm trying to put in some meagre additional malware prevention measures, by restricting the execution of *.exe in a handful of locations -- in particular, the temporary folders that various ...
0
votes
1answer
1k views

Account lockouts not in Event Viewer

I am having trouble getting Windows Server 2008 to log when domain user accounts are being locked. My Domain Controllers are all Windows Server 2008 R1. I am able to find Audit Failure events (ID ...
0
votes
0answers
18 views

Assigning random IPv6 ranges to ISPs as a security measure [migrated]

Pinging all the IPv4 address space takes about 5 hours (and can generate beautiful maps). Port-scanning doesn't take much longer and can reveal vulnerable services, such as remote administration of ...
-3
votes
0answers
30 views

VPS Security beginner [closed]

I'm a beginner on VPS and I'm trying to learn for myself how to manage it and everything but I have some doubts about how to secure my magento website. I'll start my vps on digitalocean, and install ...
0
votes
0answers
15 views

Recommandations for sharing the internet connection: over a router or server? [closed]

Being aware of the fact that the settings that a router has can be applied on a server as well, I still consider to be a generally safer way to have the Internet first to be connected to a router. The ...
1
vote
2answers
2k views

windows 2008 R2 TS printer security - can't take owership

I have a Windows 2008 R2 server with Terminal server role installed. I'm seeing a problem with an ordinary user who is member of local printer operators group on the server. If the user opens a cmd ...
3
votes
5answers
64 views

Should I enable automatic security updates on a Ubuntu server? [closed]

I can't seem to find an agreed answer on this anywhere, so I figured I'd ask it myself. I have five Ubuntu servers running either 12.04 or 14.04, should I enable automatic security updates on these ...
0
votes
1answer
2k views

Open port 8009/tcp on Fortigate necessary?

A nmap scan of a Fortigate Firewall showed that TCP port 8009 open is. According to knowledge base articles this is only to download the client for ssl vpn. Is this port used for anything else, and if ...
1
vote
1answer
4k views

Error 4673 audit failure filling security logs

I have an isolated desktop computer in my office that I run weekly security audits on. I check the logs for odd behavior then export and clear them out. The logs are filled with "Audit failure ...
35
votes
5answers
81k views

How do I grant start/stop/restart permissions on a service to an arbitrary user or group on a non-domain-member server?

We have a suite of Windows Services running on our servers which perform a bunch of automated tasks independently of one another, with the exception of one service which looks after the other ...
3
votes
0answers
25 views

MongoDB Oplog Security

We are using a MongoDB replica set for sharing sessions and other (potentially sensitive) data in a web farm. All the data we store uses TTL indexes to expire documents after a relatively short ...
1
vote
1answer
123 views

How to prevent a XenU domain from being saved

Xen (like other) virtual machines allows VMs to be saved and resumed. Xen on Debian Lenny, for instance, is configured to save and resume virtual machines on Dom0 restarts. Is it possible to have ...
3
votes
3answers
2k views

Apache getting hammered by nonsense requests, how to stop?

My VPS is getting hammered with attempts on random files/directories that don't exist on my server, in the order of roughly twice every second. Presumably it's just a bot trying to figure out whether ...
1
vote
1answer
142 views

Which “try_files” nginx directive is best for the zero-day exploit?

So far I have been using the following in the php location of my nginx config files try_files $uri $uri/ /index.php?$query_string; However, I just saw in the Wordpress Codex guide that for the ...
2
votes
0answers
59 views

Stop senseless mass-queries on DNS-server [duplicate]

I have a disturbing problem for a few weeks now ... One of my three DNS-servers (running bind9 as slave of a Plesk DNS master) is getting spammed with senseless DNS requests. The origin IPs of those ...
-1
votes
2answers
25 views

Change Mail Password, leave user system password

I have a Debian Jessie server that provides (web-)mail using postfix, dovecot and roundcube. To log-in to roundcube webmail, I have to use my system user name and password. This seems like a major ...
4
votes
2answers
1k views

How found suspect connection in a netstat output?

It seems some ssh brute force are outgoing from my debian 7.1. I'm searching how to find the source of these brute force. I'm searching in netstat output, but how can i identify trace of this hack ? ...
5
votes
1answer
1k views

certutil -ping fails with 30 seconds timeout - what to do?

The certificate store on my Win7 box is constantly hanging. Observe: C:\>1.cmd C:\>certutil -? | findstr /i ping -ping -- Ping Active Directory Certificate Services Request ...
0
votes
1answer
67 views

CentOS vs Ubuntu Wordpress server security

I am building out a new Wordpress server for a web developer redesigning my companies website. I originally decided to go with CentOS due to stability. However it appears based on the versions of ...
0
votes
1answer
1k views

Most secure: Authentification point at Citrix Access Gateway, or Web Interface

At our company we have XenApps accessible through Citrix Access Gateway. I am looking through the settings and i can see under the Web Interface settings that the authentication point is set to be "at ...
0
votes
1answer
237 views

Event 4625 Audit Failure NULL SID failed network logons

In a small environment comprised of one Windows Small Business Server 2011 server of relatively limited use (domain controller / Active Directory and DNS, Group Policy, DHCP, file server, print ...
0
votes
0answers
16 views

Postfix: rewrite “From” header and Sender Envelope with SASL username [duplicate]

I set up an authenticated mail server, in which a user needs an account to send mail. The SMTP username is the sender's email. The problem is that any authenticated user can send email with any from ...
0
votes
1answer
1k views

Enabling cipher TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) on Windows Server 2003+ISA 2006

I have been given a task to disable all "weak" ciphers/protocols on our very old ISA server based on Windows Server 2003. I have disabled all protocols but TLS1.0, and all ciphers but RC2/128, RC4/128 ...
4
votes
5answers
2k views

How can I make an internet facing TFTP server secure?

I have many Cisco IP phones that operate in the following manner (oversimplified): Negotiate with DHCP for IP, DNS, TFTP, etc. Look for SEPXXXXXXXXXXXX.cnf.xml configuration file on TFTP server ...
0
votes
1answer
10 views

What are the Security Implications of not fully overwriting a fresh LUKS disk prior to use

I recently read this nice Howto tutorial about doing backups with whole disk encryption using LUKS. Surprisingly for me this tutorial contains as the first part of step #3 a command to overwrite the ...
-1
votes
1answer
41 views

Is it a ok wordpress file or is hack, look at this code [duplicate]

I was facing a hack My website is not hosted on a server but shared hosting, If server is hacked I cannot do anything. My Question is not about how to safeguard the server, but is the below code is ...
0
votes
2answers
1k views

Passed SSL checker, but browser doesn't show secure?

I've set up my SSL certificate following the instructions at http://splittingelectrons.wordpress.com/2012/02/24/how-to-configure-an-ssl-certificate-for-apache-on-amazon-ec2/ I've checked my website ...