Security is not a product, but a process.

learn more… | top users | synonyms (2)

2
votes
3answers
2k views

WMI permissions: Select CommandLine, ProcessId FROM Win32_Process returns no data for CommandLine

I am gathering performance data via WMI and would like to avoid having to use an account in the Administrators group for this purpose. The target machine is running Windows Server 2003 with the latest ...
64
votes
6answers
37k views

How to test if my server is vulnerable to the ShellShock bug?

How can I ensure my Bash installation is not vulnerable to the ShellShock bug anymore after the updates?
2
votes
2answers
236 views
+50

Restricting the network access of Docker container

I'm in the process of creating an SFTP only Docker container, one that will be used by multiple people for the sole purpose of uploading and managing files in their own Chrooted Environment. On ...
1
vote
3answers
98 views
+50

Disable Windows Share Without Administrator Access

We have a folder on a windows server shared to provide access to an important application. When the application is being updated we (DBAs) change the permissions on the share to deny all access to it ...
30
votes
4answers
64k views

How do I grant start/stop/restart permissions on a service to an arbitrary user or group on a non-domain-member server?

We have a suite of Windows Services running on our servers which perform a bunch of automated tasks independently of one another, with the exception of one service which looks after the other ...
0
votes
0answers
18 views

Should a NAT host be separate from a Bastion host

Have a private network with servers that required SSH access. Since the instances are in a private subnet, they cannot be accessed directly via SSH and require a public Bastion host to access. ...
272
votes
3answers
267k views

What is a Pem file and how does it differ from other OpenSSL Generated Key File Formats?

I am responsible for maintaining two Debian servers. Every time I have to do anything with security certificates, I Google for tutorials and beat away until it finally works. However, in my searches ...
0
votes
1answer
27 views

“File not found” from bash script executed by Apache (CentOS)

I have a bash script that sets up a classpath for accessing a series of JARs (it's tf, the cross-platform, command line tool for Team Foundation Server). The file structure is something like: ...
1
vote
1answer
24 views

how should I configure selinux when running nginx inside docker

There's a good article in docker's documentation about security with docker : https://docs.docker.com/articles/security/ However, it's not very clear to me how root-priviledged processes in the ...
0
votes
1answer
12 views

SCCM 2012 Software Update role - Can I still use WSUS?

I manage a network of about 1200 workstations and about 200 or so servers. We have migrated away from McAfee in favor of System Center Endpoint Protection for our corporate Anti-Malware solution. ...
3
votes
3answers
1k views

OpenBSD has open ports in default installation

I have been considering replacing Ubuntu with OpenBSD to improve the security on my local server. I need to have ssh access to it, and I also need it to serve static web content - so the only ports I ...
0
votes
2answers
22 views

Is PHP 5.3.3 on RHEL 6.5 receiving security fixes?

I notice that the latest PHP available on RHEL 6.5 is PHP 5.3.3. See Distrowatch and also my own check: $ php -v PHP 5.3.3 (cli) (built: Jul 15 2014 08:48:08) However, the PHP website claims that ...
3
votes
1answer
82 views

How to authenticate a user from an external Windows Domain (Active Directory)

I have a service (AcmeService) running on a domain (ACME.COM) and a user running in another domain (DISNEY.COM). mickey@disney.com wants to authenticate with the AcmeService. The service knows about ...
4
votes
1answer
1k views

Why are some CentOS 5 boxes still vulnerable to ShellShock after upgrading Bash?

I have two CentOS 5.10 boxen where I have upgraded bash to the latest version. However, in one of the boxes, bash is still vulnerable to CVE-2014-7169 (I am using the test from this ServerFault ...
13
votes
7answers
9k views

Automatically check for Security Updates on CentOS or Scientific Linux?

We have machines running RedHat-based distros such as CentOS or Scientific Linux. We want the systems to automatically notify us if there are any known vulnerabilities to the installed packages. ...
1
vote
1answer
22 views

CRM 2013 Internet Facing Deployment (IFD)

For previous CRM IFDs I have placed the CRM Front End server in the DMZ along with an ADFS Proxy and allowed access from the Domain Controller to the CRM Front End through the firewall. This is ...
1
vote
1answer
25 views

How can I install a client certificate for all users of a computer?

I have a PFX file (.p12) that is needed to allow access a remote web page. Double-clicking on this file and following a few prompts easily adds the certificate to a personal store, but this only works ...
-4
votes
1answer
105 views

Is WampServer on Windows vulnerable to Bash Bug / Shell Shock? [closed]

The title says it all. I don't think Wamp is running with Cygwin but I would like to be sure of that.
11
votes
2answers
3k views

How does the updated Shellshock vulnerability test for CVE-2014-7169 work?

I understand the original test for CVE-2014-6271, which was: $ env x='() { :;}; echo vulnerable' bash -c "echo this is a test" But I'm confused by the updated test and corresponding output for ...
0
votes
0answers
24 views

Dell 5548P, MIB value for port security violation notification

Anyone have idea on MIB values(OID value) for Port security violation notification with dell 5548P switches.On Cisco its [1.3.6.1.4.1.9.9.315.0], not sure whether i can use the same for montioring ...
0
votes
1answer
19 views

MySQL via SSL on VPC private subnet

Is an SSL connection recommended when connecting to a MySQL database server via a private subnet? SSL provides encryption but SSL causes a performance hit. The MySQL database server only serves ...
1
vote
2answers
2k views

windows 2008 R2 TS printer security - can't take owership

I have a Windows 2008 R2 server with Terminal server role installed. I'm seeing a problem with an ordinary user who is member of local printer operators group on the server. If the user opens a cmd ...
9
votes
2answers
2k views

Why is “AcceptEnv *” considered insecure?

In /etc/ssh/sshd_config, there is an option called AcceptEnv that allows the ssh client to send environment variables. I need to be able to send a large number of environment variables. These change ...
1
vote
1answer
10 views

Sent mail/login log for roundcube webmail

Does roundcube webmail have a log for logins, or for sent mail? I searched everywhere but could only located the "error log" directory in roundcube, not one for logins or for sent mail. I'm trying to ...
1
vote
1answer
27 views

Roundcube does not add IP address information into sent emails

Usually the mail client is supposed to add IP information into emails, in order for the sender to be tracked. But when you send emails from Roundcube Webmail/0.8.4+, the IP address of the server is ...
0
votes
2answers
83 views

Arp attack on my network

We have a small network of around 100 laptop/desktops and around 20 servers (sounds an overkill but these servers provide service for all our external contractors too) and we have recently noticed ...
0
votes
1answer
795 views

Most secure: Authentification point at Citrix Access Gateway, or Web Interface

At our company we have XenApps accessible through Citrix Access Gateway. I am looking through the settings and i can see under the Web Interface settings that the authentication point is set to be "at ...
0
votes
1answer
31 views

How to change password complexity for mailbox in exchange 2013

I find the default password policy in exchange pretty weak (only 6 char.). Is there a way to change this password policy ? e.g. : Minimum 1 cap, Minimum 8 letters. Thank you !
0
votes
0answers
9 views

Rename IWAM and IUSR accounts on cloned servers

We cloned couple of servers and all of the new ones have the same name for IUSR and IWAM accounts. Now as per my understanding, these are local accounts and should be fine. Do I really have to/should ...
0
votes
1answer
1k views

How to enable connection security for WMI firewall rules when using VAMT 2.0?

I want to use VAMT 2.0 to install product keys and active software in remote machines. Everything works fine as long as the ASync-In, DCOM-In, and WMI-In Windows Firewall rules are enabled and the ...
0
votes
1answer
728 views

Memory Pressure Protection Feature for TCP Stack - Provided by Microsoft Security Update KB967723

We've been having a lot of funky issues with some of our web based applications that allow clients to submit lot of image files to our servers. Lots of ports are used in the process. ...
-2
votes
0answers
20 views

Microsoft Azure Internal Network Security

I happened to notice some strange connection attempts in /var/log/secure on our Microsoft Azure VM. I've also noticed that the default setting for iptables is: Chain INPUT (policy ACCEPT) ...
7
votes
2answers
124 views

Storing AWS credentials securely on a personal machine

How can I securely store AWS credentials on personal machines? In detail: Everybody in our team requires AWS security credentials for doing administrative tasks (credentials are separated by role). ...
4
votes
7answers
10k views

How to disable CD-ROM and USB for normal users in Linux?

How can access to CD-ROM and USB be disabled for normal users in Linux? As a part of security policy we need to disable CD-ROM and USB access for normal users. Only root users should have the access. ...
3
votes
1answer
864 views

certutil -ping fails with 30 seconds timeout - what to do?

The certificate store on my Win7 box is constantly hanging. Observe: C:\>1.cmd C:\>certutil -? | findstr /i ping -ping -- Ping Active Directory Certificate Services Request ...
-1
votes
5answers
627 views

Securing Remote Desktop Server on Windows 7 For Internet Use

I have a desktop and laptop both running Windows 7 Professional. My goal is to secure the desktop so that I can securely use "Remote Desktop" over the Internet from ONLY the laptop. I have already ...
0
votes
1answer
14 views

Detect files of folders which do not inherit permissions from their parent

Is there an easy way to find any files/folders (recursively) within a directory which do not inherit permissions from their parent. i.e. To gauge the effects of selecting "replace permissions on ...
0
votes
0answers
16 views

802.1x Log.txt log file

I have a network that have a basic PC > SWITCH > RADIUS server structure ... and i noticed that every p.c on the network have a c:\8021x folder that contain a log.txt file ... and on the log.txt i ...
0
votes
0answers
19 views

Where can I find a collection of tried and true Security Protocols? [migrated]

Just as it's a good idea not to invent your own encryption standard (unless you are an expert), I'm assuming that it's also not a good idea to invent your own security protocol. Since I'm probably ...
0
votes
2answers
123 views

Nginx, ModSecurity, IP Tables blocking WordPress dos/ddos attack

For the past 14 days I have had my website being hit by millions of WordPress installs over the world which .htaccess is kind of coping with but I am trying to get something to kick them before ...
0
votes
2answers
4k views

Fortigate 40c Firewall Configuration

Does anybody know if is it possible to Un-bridge ports on forgiate 40c? I want to use the fortigate 40c to define and control (block/allow) port traffic for the following 4 ip ranges (each ip range ...
0
votes
1answer
40 views

Do all captive portal solutions work the same way? (cookie, vs MAC address, vs other?)

While traveling and having to interact with a number of broken captive portal implementations I've overheard other passengers having usability issues with iPads, Phones, computers depending on the ...
0
votes
1answer
38 views

Using SHA256 with SSL certificates in HAProxy

Through an article on Security Labs I read about Google deprecating SHA-1 as signature in Chrome next year. Now I want to edit our HAProxy SSL configuration to fit the new security needs. What are ...
5
votes
8answers
669 views

Identifying changed files on *nix webserver

Looking for some (*nix) software which will build an index of "interesting" files on a server and notify when certain of those files contents are modified, or new files appear. Similar to rkhunter et ...
18
votes
2answers
1k views

Customer wants open postgresql port, how to make that secure?

So, this is the situation. It seems, we need to have an open tcp port 5432 for the world, where a customer has access to his postgresql database. Because obvious reasons, we can't say just "no", only ...
1
vote
2answers
786 views

Getting Windows 7 to run Scripts from Other Shares then NETLOGON

I have several Windows Server 2003 Environments I administer. These are separate disparate domains with their own structures and policies. I generalize as much as possible when I administer these ...
-1
votes
3answers
121 views

Security policy: servers without root/administrator password

I am considering running public web and application servers with blank root/Administrator passwords, and I'm wondering whether this might be a bad policy. I see several advantages of having no ...
2
votes
1answer
299 views

Duplicate Administrator Accounts

Somehow, I have a Windows 2003 Server that has two local Administrator accounts that have the same SID (S-21-xxxxxxxxx-500). Therefore, normal utilities don't let me delete them. (Can't delete a ...
2
votes
1answer
41 views

Executing WMI methods by proxy - how can I keep credentials out of the hands of users?

Management wants me to create a script/application/ancient magical artifact that allows field technicians to perform a task on our Configuration Manager server (updating collection memberships - very ...
-1
votes
1answer
49 views

Is the PHP option 'cgi.fix_pathinfo' really dangerous with Nginx + PHP-FPM?

There has been a lot of talking about a security issue relative to the cgi.fix_pathinfo PHP option used with Nginx (usually PHP-FPM, fast CGI). As a result, the default nginx configuration file used ...