Security is not a product, but a process.

learn more… | top users | synonyms (1)

425
votes
13answers
85k views

How do I deal with a compromised server?

This is a Canonical Question about Server Security - Responding to Breach Events (Hacking) See Also: Tips for Securing a LAMP Server Reinstall after a Root Compromise? Canonical ...
136
votes
3answers
12k views

I am under DDoS. What can I do?

This is a Canonical Question about DoS and DDoS mitigation. I found a massive traffic spike on a website that I host today; I am getting thousands of connections a second and I see I'm using all ...
189
votes
5answers
181k views

What permissions should my website files/folders have on a Linux webserver?

This is a Canonical Question about File Permissions on a Linux web server. I have a Linux web server running Apache2 that hosts several websites. Each website has its own folder in /var/www/. /var/...
78
votes
5answers
13k views

Tips for Securing a LAMP Server

This is a Canonical Question about Securing a LAMP stack What are the absolute guidelines for securing a LAMP server?
189
votes
9answers
29k views

Heartbleed: What is it and what are options to mitigate it?

This is a Canonical Question about understanding and remediating the Heartbleed security issue. What exactly is CVE-2014-0160 AKA "Heartbleed"? What is the cause, what OSs and versions of OpenSSL ...
17
votes
6answers
22k views

Cygwin SSHd Autoblock Failed Logins

I'm running Cygwin with an SSH deamon on a Windows Server 2008 machine. I was looking at the Event Viewer and noticed as much as 5 to 6 failed login attempts per second (brute force) for the last week ...
50
votes
6answers
4k views

Reinstall after a Root Compromise?

After reading this question on a server compromise, I started to wonder why people continue to seem to believe that they can recover a compromised system using detection/cleanup tools, or by just ...
196
votes
22answers
57k views

Is it normal to get hundreds of break-in attempts per day?

I just checked my server's /var/log/auth.log and found that I'm getting over 500 failed password/break-in attempt notifications per day! My site is small, and its URL is obscure. Is this normal? ...
48
votes
8answers
4k views

Why would I need a firewall if my server is well configured?

I admin a handful of cloud-based (VPS) servers for the company I work for. The servers are minimal ubuntu installs that run bits of LAMP stacks / inbound data collection (rsync). The data is large ...
41
votes
14answers
6k views

Preventing brute force attacks against ssh?

What tool or technique do you use to prevent brute force attacks against your ssh port. I noticed in my Security logs, that I have millions of attempts to login as various users through ssh. This is ...
90
votes
21answers
19k views

Why should I firewall servers?

PLEASE NOTE: I'm not interested in making this into a flame war! I understand that many people have strongly-held beliefs about this subject, in no small part because they've put a lot of effort into ...
56
votes
15answers
10k views

Are IP addresses “trivial to forge”?

I was reading through some of the notes on Google's new public DNS service: Performance Benefits Security Benefits I noticed under the security section this paragraph: Until a standard system-...
36
votes
9answers
24k views

Why not block ICMP?

I think I almost have my iptables setup complete on my CentOS 5.3 system. Here is my script... # Establish a clean slate iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT ...
18
votes
5answers
13k views

How can I chroot ssh connections?

I would like to setup a chroot jail for most (not all) users logging in though SSH. I've heard it's possible with the latest versions of openssh, but I've not been able to find out how to do it. The ...
1384
votes
28answers
321k views

Our security auditor is an idiot. How do I give him the information he wants?

A security auditor for our servers has demanded the following within two weeks: A list of current usernames and plain-text passwords for all user accounts on all servers A list of all password ...
312
votes
21answers
54k views

How do you search for backdoors from the previous IT person?

We all know it happens. A bitter old IT guy leaves a backdoor into the system and network in order to have fun with the new guys and show the company how bad things are without him. I've never ...
27
votes
10answers
30k views

How do I know if my Linux server has been hacked?

What are the tell-tale signs that a Linux server has been hacked? Are there any tools that can generate and email an audit report on a scheduled basis?
57
votes
6answers
12k views

Heartbleed: are services other than HTTPS affected?

The OpenSSL 'heartbleed' vulnerability (CVE-2014-0160) affects webservers serving HTTPS. Other services also use OpenSSL. Are these services also vulnerable to heartbleed-like data leakage? I'm ...
80
votes
8answers
40k views

Heartbleed: how to reliably and portably check the OpenSSL version?

I was looking at a reliable and portable way to check the OpenSSL version on GNU/Linux and other systems, so users can easily discover if they should upgrade their SSL because of the Heartbleed bug. ...
10
votes
5answers
5k views

Is it worth the effort to block failed login attempts

Is it worthwhile running fail2ban, sshdfilter or similar tools, which blacklist IP addresses which attempt and fail to login? I've seen it argued that this is security theatre on a "properly secured"...
12
votes
3answers
2k views

Apache: Scammers point dozens of domain names at my dedicated IP. How to prevent this?

For the sake of discussion, pretend that I have an Apache webserver which serves a website at www.example.org. This domain name resolves to the public IP address at 192.168.1.100 (pretend this is a ...
11
votes
6answers
3k views

Does disabling root login enhance security?

I have recently found an argument against disabling a root user login in Linux at http://archives.neohapsis.com/archives/openbsd/2005-03/2878.html I assume that, if everybody uses a public key ...
66
votes
8answers
46k views

What steps do you take to secure a Debian server? [closed]

I am installing a Debian server which is connected directly to the Internet. Obviously I want to make it as secure as possible. I would like you guys/gals to add your ideas to secure it and what ...
50
votes
40answers
5k views

How do you manage your passwords?

Obviously seeing as how many of us here are system administrator type people, we have a lot of passwords strung out across numerous systems and accounts. Some of them are low priority, others could ...
48
votes
5answers
39k views

REJECT vs DROP when using iptables

Is there any reason why I would want to have iptables -A INPUT -j REJECT instead of iptables -A INPUT -j DROP
11
votes
7answers
15k views

How to log every linux command to a logserver

I want every single command typed to go to a logserver. Already configured is the syslog-ng to send all logs to the logserver. I'm interested in any and all methods to do this. I would expect ...
15
votes
1answer
1k views

How to do a post-mortem of a server hack

I have a Windows Server 2003 SP2 machine with IIS6, SQL Server 2005, MySQL 5 and PHP 4.3 installed on it. This is not a production machine, but it is exposed to the world via a domain name. Remote ...
4
votes
5answers
2k views

Deep Format of a Harddrive on a Linux System

I've got an original Asus Eee PC Netbook that I'd like to sell. When I've sold old computers in the past, I've typically done a deep/secure/zeroing out style format. How can I do this on a Linux ...
11
votes
3answers
5k views

Is it possible to have a 100% secure virtual private server?

I am curious if it is possible to have a VPS that has data on it that is not readable by the hosting provider, but is still usable on the VPS. Obviously there are some things that you could do to ...
93
votes
6answers
31k views

SSH keypair generation: RSA or DSA?

SSH supports two signature algorithms for key pairs: RSA and DSA. Which is preferred, if any? For RSA, what is the minimum acceptable key length?
18
votes
3answers
47k views

Iptables: How to allow only one ip through specific port?

How can I on my ubuntu server, in Iptables only allow one IP adress on a specific port? Thanks
22
votes
5answers
19k views

Does fail2ban do Windows?

Can anyone recommend a fail2ban-like tool for a Windows OS? I've got a couple of Windows Media servers that get hammered with brute force authentication attempts. I would like to plug these ...
10
votes
12answers
2k views

Securing SSH server against bruteforcing

I have a little SVN server, old dell optiplex running debian. I don't have that high demands on my server, because its just a little SVN server... but do want it to be secure. I just renewed my ...
18
votes
3answers
50k views

Force authenticated user immediate logoff (emergency case)

In Active Directory if you want to prevent a user from logging in you can either disable their account or simply reset their password. However, if you have a user who is already logged in to a ...
10
votes
2answers
3k views

linux command to prevent dos attack by using netstat and iptables

I want to DROP more than 200 requests per ip to prevent ddos attack. this is command that i used to detect requests count per ip : netstat -alpn | grep :80 | awk '{print $5}' |awk -F: '{print $(NF-1)}...
10
votes
4answers
736 views

Updating Malware cleaning skills

I have seen some sites offering 'Malware University', training classes on getting rid of malware. Do you think that updating your malware removal skills (or arsenal) is necessary from time to time? ...
16
votes
19answers
4k views

How should I securely wipe data from a hard drive?

How do you recommend destroying sensitive information on a hard drive? I've used DBAN in the past, is that good enough?
9
votes
6answers
6k views

How can I log users' bash commands?

I'm running a debian etch server where users will be logging into (hopefully) a chroot jail through ssh. How can I have the commands they execute logged in a way they cannot delete, nor prevent?
2
votes
2answers
249 views

MySQL allows entry without Password [duplicate]

I have configured my MySQL Database to require passwords on all users, even root from the machine itself. Now I discovered that there are empty Users in my Database Reproduce: mysql -u root -p and ...
10
votes
3answers
2k views

How to tell if a public SSH key has a passphrase

This is probably a noob question, but how can I determine if the public SSH key someone gives me has a passphrase or not? We have a situation where I am not generating the SSH keys for users, but I ...
5
votes
8answers
4k views

What is the best Antivirus for a Windows Domain Network? [closed]

What is the best Antivirus for a Windows Domain Network?
3
votes
1answer
647 views

Apache upgrade strategy

I'm on CentOS 6.5 and Apache 2.2.15. I wanted my httpd to be up to date so I did: yum update httpd After that it is still version 2.2.15, but latest version is 2.2.22. I also see security updates ...
34
votes
10answers
14k views

Securing a fresh Ubuntu server [closed]

Say I've got a fresh install of Ubuntu, what steps should I take to secure it for use as a Rails application server?
71
votes
6answers
56k views

How to test if my server is vulnerable to the ShellShock bug?

How can I ensure my Bash installation is not vulnerable to the ShellShock bug anymore after the updates?
39
votes
2answers
106k views

How to grant network access to LocalSystem account?

How do you grant access to network resources to the LocalSystem (NT AUTHORITY\SYSTEM) account? Background When accessing the network, the LocalSystem account acts as the computer on the network: ...
19
votes
10answers
24k views

Live view of Linux shell commands executed by another user?

Is it possible for the root user in Linux to have a real-time (or close to real-time) view of the shell commands being run by another user logged in via a terminal or SSH? Obviously they're stored in ....
23
votes
15answers
4k views

Recommend an intrusion detection system (IDS/IPS), and are they worth it?

I have tried out various network-based IDS and IPS systems throughout the years and have never been happy with the results. Either the systems were too difficult to manage, only triggered on well-...
33
votes
3answers
73k views

How can I allow one user to su to another without allowing root access?

I'd like to allow certain users to su to another user account without having to know that account's password, but not allow access to any other user account (i.e. root). For instance, I'd like to ...
16
votes
10answers
147k views

Best way to find the computer a user last logged on from?

I am hoping that somewhere in Active Directory the "last logged on from [computer]" is written/stored, or there is a log I can parse out? The purpose of wanting to know the last PC logged on from is ...
29
votes
5answers
2k views

Avoid to keep command in history

I use bash and I would like to avoid some commands being kept in the history. Is it possible to do that for the next command only? Is it possible to do that for the entire session?