Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
0answers
6 views

Is a root kit not an exploit? [migrated]

I once referred to the bluepill rootkit from 2006 as an exploit. I was corrected and told that root kits aren't exploits. Is this true? I thought an exploit included any software that was used to ...
-1
votes
0answers
10 views

Do UDP process in netstat-ano command means being hacked? [on hold]

If yes how to stop them permanently.. I am getting these pid's for svchost.exe process whwn i check in task manager Checking for pid(process id ) again and again is not good
0
votes
0answers
11 views

AWS security group change

I modified the security group for two VMs on AWS (from one security group to another - not just editing the security rules of an existing group). The VM's are behind Amazon ELB (and using Route 53). ...
1
vote
3answers
641 views

OSSEC disk space usage

A few days ago I noticed that the disk of my Ubuntu server was almost full. I dug a bit and found out that the disk space was used by OSSEC, in the /var/ossec/queue/diff folder. I wanted to try ...
0
votes
0answers
17 views

Secure Storage Requirements in the Cloud [on hold]

I'm trying to understand some low-level security requirements for a cloud based secure storage solution. Specifically, I'm interested in the following: What mode of encryption (and integrity ...
21
votes
2answers
31k views

How to inspect remote SMTP server's TLS certificate?

We have an Exchange 2007 server running on Windows Server 2008. Our client uses another vendor's mail server. Their security policies require us to use enforced TLS. This was working fine until ...
0
votes
1answer
15 views

Printer installed on terminal server 2012 only works with group “everybody”

I'm trying to restrain access to printers on my terminal server. The printers are installed directly on the server because we're using thin clients to connect, so people don't have a local default ...
9
votes
6answers
6k views

Send email when anyone logs on

My CentOS/RHEL system may have been hacked, I'm not sure. But I'm playing it safe by creating a new slice from scratch. I've installed tripwire, but I'd also like to be emailed when anyone logs in. I ...
0
votes
1answer
26 views

Subdomain for every customer or one domain for everyone?

I want to offer an application to customers. I see that many applications on the internet have subdomain created for every client when he is creating an account. Is this good practice in terms of ...
2
votes
0answers
38 views

Privacy concerns with windows 10 Pro

I don't need any of the Windows 10 enterprise features but enterprise is the only one that (legitimately) allows me to turn off the CEIP (Customer Experience Improvement Program); this is the ...
0
votes
2answers
81 views

Kali Linux Running in AWS

Normally I run Kali in a virtualbox VM however due to the nature of a project it may be useful to run Kali from an AWS EC2 instance. So imagine my joy when I learned there was a Kali AMI only to be ...
4
votes
2answers
1k views

How to set up two-factor authentication with OTP on FreeBSD?

I have a FreeBSD server that I like to be able to get to from anywhere. Normally I use SSH publickey to log in, or if I don't have my SSH private key available then I might use regular password over ...
4
votes
2answers
3k views

Windows 2008 R2 Server Security Log filling with event 521

I understand that status code 0xc0000008 means Invalid Handle. How do you resolve this issue (besides a restart)? What is the best way to determine the cause for this? Log Name: Security ...
0
votes
1answer
27 views

Is there some project/tool for testing web server firewall quality? [closed]

Would like to have a test with different aspects of firewalls. For instance, a test that would output info on: Layer 3/4 attacks DNS amplification attacks SMURF attacks ACK attacks Layer 7 attacks ...
2
votes
1answer
1k views

Securing an Apache Setup with a Fresh Ubuntu Web Server with users and permissions

I have a virtual Server with Ubunto 10.04 on. My host Mediatemple have a few guides on trying to secure the apache config, but I think they are missing some details, or at least it makes no sense to ...
0
votes
0answers
12 views

Configuring nginx + Laravel to not execute any other PHP files

I have a Laravel application hosted on nginx, using a fairly standard php-fpm configuration. There should be no need to execute any other PHP files on the server, except for one specific script that ...
0
votes
2answers
494 views

How to prevent password expiration in apache Archiva

I am running a standalone Archiva 2.2.0 installation. I added security.properties file to ~\conf directory. In security.properties I defined: security.policy.password.expiration.days=999999 ...
3
votes
3answers
327 views

Suspicious password login in sshd log

I have a linux server running under a windows virtualbox. I use ssh with publickey to login, and use lftp's sftp feature for file transfer, which also use publickey. Today when I check the log file, ...
-2
votes
1answer
47 views

TLS auth issue: 'CompanyA@exmple.com “via” SendGrid.me' email is dropped by Exchange [closed]

Looking for clarification about what this Exchange 2007 Management Shell (Powershell) command does and how it affects TLS at the Receive Connector: ms-exch-smtp-accept-authoritative-domain-sender ...
3
votes
2answers
1k views

Is a reboot required for SSL V3 disable on Windows? - Poodle exploit

We are trying to disable SSL V3 on numerous windows servers; as a part of it , registries are being updated remotely via script. Problem is lots of reboots are required post registry change. Is there ...
0
votes
1answer
135 views

Jenkins 2.x disable initial admin setup

we're using Jenkins as a cron server adding/starting crons via api. We created a vagrant box installing the jenkins. Since version 2.0 jenkins require to create an admin account (link) before disable ...
17
votes
3answers
5k views

Automatically Applying Security Updates for AWS Elastic Beanstalk

I've been a fan of Heroku since it's earliest days. But I like the fact that AWS Elastic Beanstalk gives you more control over the characteristics of the instances. One thing I love about Heroku is ...
0
votes
1answer
27 views

Jenkins login using GitHub Authentication failed being administrator

I was setting up authentication mechanism for our organization jenkins, which had no security mechanism, "ananoumos" can do anything, delete jobs,build etc. I did Install github-oauth jenkins plugin ...
2
votes
0answers
17 views

Enforcing audit settings for all subfolders and files on NTFS

On Windows 7 I would like to enforce auditing on all subfolders and files for a specific local folder, by using the included Windows auditing features. When a user moves a file from the same NTFS ...
3
votes
1answer
1k views

Mod Security ctl:ruleEngine=Off Whitelist Fails in Phase 1 [closed]

mod_security with custom rules and whitelists in separate .conf files - Apache 2.2, modsec 2.8 Whitelist rule: SecRule REMOTE_ADDR "^10\.10\.10\.10" phase:1,nolog,allow,ctl:ruleEngine=Off,id:104008 ...
3
votes
4answers
3k views

WMI permissions: Select CommandLine, ProcessId FROM Win32_Process returns no data for CommandLine

I am gathering performance data via WMI and would like to avoid having to use an account in the Administrators group for this purpose. The target machine is running Windows Server 2003 with the latest ...
-1
votes
2answers
38 views

Connect to AWS EC2 SSH for public location best practice

I have recently been learning about how to set up and run a Linux server on Amazon and I have been wondering about the best practice for SSH into it from a public place. By public place I mean like a ...
-1
votes
0answers
27 views

Bulk apply security settings Server 2012 R2 DC [closed]

I want to apply the same permissions across several entire drives for the same user on a specific machine. I want to give this user a restricted account to only access 1 certain folder on 1 drive out ...
0
votes
1answer
76 views

Is there some way a user with an asterisk as password in /etc/shadow but a correct login shell in /etc/passwd would be able to login via SSH?

Let's assume the following. We have a server which is accessible via SSH. There is an user in /etc/passwd who has a valid login shell (so for example /bin/bash, instead of an invalid one like /bin/...
0
votes
1answer
31 views

Getting a safe access to a computational server [closed]

Disclaimer: I'm not a sysadmin, so I might say stupid things / rely on incorrect assumptions. Feel free to correct me. I work in a startup and some time ago we bought a server for internal use for a ...
1
vote
2answers
242 views

Setting up IIS 8.5 - Security practices

This is the first time I'm setting up an IIS installation and i want to make sure to provide maximum security. Some questions were popping into my mind while setting up: Note that this server hosts ...
0
votes
1answer
92 views

Authentication Configuration with IIS 8.5 on Windows Server 2012

I have a site hosted using IIS on a Windows Server 2012 R2 server. The application is configured to use an application pool that uses the NetworkService account as the application pool identity. The ...
0
votes
1answer
35 views

LAMP/Apache2: How to set webhook API PHP file as public but outside of project root directory?

I have an AWS EC2 LAMP server (using Apache 2.0 and mod_php5) with a basic directory structure like this: var |-- www | `-- api_folder (NOT public) | | |-- sensitive files (NOT ...
30
votes
7answers
8k views

Good idea? Refuse incoming emails with our own domain ending? (because they must be fake)

I have a question about our Exchange Server: Do you think it is a good idea to refuse incoming external e-mails that have our own domain in the ending? Like external eMail from fake@example.com? ...
0
votes
1answer
31 views

How can I process auditd logs on the fly using ausearch?

I want to ship off logs into centralized logging (ELK). Because of the way things are, I need to do the processing on the machine that creates the logs. How can I get each new auditd event to ...
1
vote
1answer
87 views

What does auditd log by default (i.e. when no rules are defined?)

I installed auditd and audispd-plugins on my Debian Jessie machine and didn't touch any configuration. I see events being written to /var/log/audit/audit.log, for example: type=LOGIN msg=audit(...
5
votes
3answers
3k views

How found suspect connection in a netstat output?

It seems some ssh brute force are outgoing from my debian 7.1. I'm searching how to find the source of these brute force. I'm searching in netstat output, but how can i identify trace of this hack ? ...
0
votes
0answers
26 views

How secure is it to use secret directory names to share files on unix? [migrated]

There is an old trick on unix systems to allow a non-root user to "securely" share files with particular other users. mkdir share chmod 711 share #others can traverse share, but can't list its ...
2
votes
2answers
81 views

Martian sources from my public IP

These days I get some Martian packets in the kern.log: Jul 7 02:28:20 box14932 kernel: [789192.798073] IPv4: martian source XXX.XXX.XXX.XXX from 10.91.12.01, on dev eth1 Jul 7 02:28:20 box14932 ...
0
votes
2answers
37 views

Powrshell Script to read the Windows Secutiry logs and filter Elevation type 196 and 1937

I have a powershell script that reads the elevation type and displays the content in powershell window. However I need to put the contents in Excel file. Please help. cls $evtLogEntries=$null $...
0
votes
1answer
3k views

Open port 8009/tcp on Fortigate necessary?

A nmap scan of a Fortigate Firewall showed that TCP port 8009 open is. According to knowledge base articles this is only to download the client for ssl vpn. Is this port used for anything else, and if ...
1
vote
4answers
141 views

do I still need to block attacks on my server once I lock it down by ip?

I have a public dedicated server that clients log in to via RDP. I am using rdpguard to block bad RDP logins attempts on my server. Recently, I locked it down to only allow specific IP addresses ...
1
vote
1answer
1k views

Network Services Write/Modify Permissions on Inetpub Folder Potiential security issues

I have an asp.net web application that runs as a Content Management system for a website. It was originally on an IIS6 Server. However the web application was recently moved to an II7 Server. After ...
8
votes
1answer
1k views

certutil -ping fails with 30 seconds timeout - what to do?

The certificate store on my Win7 box is constantly hanging. Observe: C:\>1.cmd C:\>certutil -? | findstr /i ping -ping -- Ping Active Directory Certificate Services Request ...
1
vote
1answer
19 views

ModSecurity duplicate anomaly logs reported instead of single

This is my second time configuring ModSecurity with the OWASP ruleset. Previously I've used version 2.2.5 of the ruleset and now on a different server 2.2.9. I'm trying to configure anomaly detection ...
0
votes
0answers
18 views

Restricting SQL Server Management Studio using LogMeIn Hamachi

I have a SQL Server 2016 instance on Windows Service 2012 VM running in Azure. Currently the network security group/firewall allows for port 1433/TCP traffic so I can connect from my PC using SQL ...
0
votes
1answer
9k views

Error 4673 audit failure filling security logs

I have an isolated desktop computer in my office that I run weekly security audits on. I check the logs for odd behavior then export and clear them out. The logs are filled with "Audit failure ...
1
vote
1answer
1k views

403 forbidden error going through aws load balancer

I am running a IIS 7 Server behind an aws load balancer. I am using a Verisign SSL certificate which is installed properly but whenever I put in the URL, or the DNS name of the load balancer I get a ...
1
vote
2answers
52 views

OpenStack Horizon behind reverse proxy (nginx preferred)

Current situation: I have a Triple-O OpenStack installation (Liberty) where even the "public" network is in a private environment (10.24.7.0/24 network). The only way to get access to that network is ...
0
votes
2answers
25 views

Strange characters in nginx log starting with \x

I was hacked and checking nginx logs I found several requests like this one: 169.229.3.91 - - [18/Jun/2016:09:42:19 +0000] ")\xE7\xD1?\xD6\x18.\xC0\xCE\xA3\x7FR\xEA~O$\x0BLi\x13\xA0m\xE7\xF0H4\x92\...