Security is not a product, but a process.

learn more… | top users | synonyms (2)

303
votes
12answers
53k views

How do I deal with a compromised server?

This is a Canonical Question about Server Security - Responding to Breach Events (Hacking) See Also: Tips for Securing a LAMP Server Reinstall after a Root Compromise? Canonical ...
80
votes
1answer
4k views

I am under DDoS. What can I do?

This is a Canonical Question about DoS and DDoS mitigation. I found a massive traffic spike on a website that I host today; I am getting thousands of connections a second and I see I'm using all ...
79
votes
4answers
50k views

What permissions should my website files/folders have on a Linux webserver?

This is a Canonical Question about File Permissions on a Linux web server. I have a Linux web server running Apache2 that hosts several websites. Each website has its own folder in /var/www/. ...
58
votes
5answers
8k views

Tips for Securing a LAMP Server

This is a Canonical Question about Securing a LAMP stack What are the absolute guidelines for securing a LAMP server?
171
votes
9answers
26k views

Heartbleed: What is it and what are options to mitigate it?

This is a Canonical Question about understanding and remediating the Heartbleed security issue. What exactly is CVE-2014-0160 AKA "Heartbleed"? What is the cause, what OSs and versions of OpenSSL ...
44
votes
6answers
3k views

Reinstall after a Root Compromise?

After reading this question on a server compromise, I started to wonder why people continue to seem to believe that they can recover a compromised system using detection/cleanup tools, or by just ...
15
votes
6answers
14k views

Cygwin SSHd Autoblock Failed Logins

I'm running Cygwin with an SSH deamon on a Windows Server 2008 machine. I was looking at the Event Viewer and noticed as much as 5 to 6 failed login attempts per second (brute force) for the last week ...
20
votes
10answers
16k views

How do I know if my Linux server has been hacked?

What are the tell-tale signs that a Linux server has been hacked? Are there any tools that can generate and email an audit report on a scheduled basis?
18
votes
5answers
11k views

How can I chroot ssh connections?

I would like to setup a chroot jail for most (not all) users logging in though SSH. I've heard it's possible with the latest versions of openssh, but I've not been able to find out how to do it. The ...
263
votes
21answers
48k views

How do you search for backdoors from the previous IT person?

We all know it happens. A bitter old IT guy leaves a backdoor into the system and network in order to have fun with the new guys and show the company how bad things are without him. I've never ...
69
votes
19answers
14k views

Why should I firewall servers?

PLEASE NOTE: I'm not interested in making this into a flame war! I understand that many people have strongly-held beliefs about this subject, in no small part because they've put a lot of effort into ...
44
votes
40answers
4k views

How do you manage your passwords?

Obviously seeing as how many of us here are system administrator type people, we have a lot of passwords strung out across numerous systems and accounts. Some of them are low priority, others could ...
48
votes
15answers
7k views

Are IP addresses “trivial to forge”?

I was reading through some of the notes on Google's new public DNS service: Performance Benefits Security Benefits I noticed under the security section this paragraph: Until a standard ...
38
votes
15answers
4k views

Preventing brute force attacks against ssh?

What tool or technique do you use to prevent brute force attacks against your ssh port. I noticed in my Security logs, that I have millions of attempts to login as various users through ssh. This is ...
30
votes
8answers
13k views

Why not block ICMP?

I think I almost have my iptables setup complete on my CentOS 5.3 system. Here is my script... # Establish a clean slate iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT ...
6
votes
5answers
3k views

Is it worth the effort to block failed login attempts

Is it worthwhile running fail2ban, sshdfilter or similar tools, which blacklist IP addresses which attempt and fail to login? I've seen it argued that this is security theatre on a "properly ...
54
votes
6answers
11k views

Heartbleed: are services other than HTTPS affected?

The OpenSSL 'heartbleed' vulnerability (CVE-2014-0160) affects webservers serving HTTPS. Other services also use OpenSSL. Are these services also vulnerable to heartbleed-like data leakage? I'm ...
44
votes
8answers
3k views

Why would I need a firewall if my server is well configured?

I admin a handful of cloud-based (VPS) servers for the company I work for. The servers are minimal ubuntu installs that run bits of LAMP stacks / inbound data collection (rsync). The data is large ...
4
votes
5answers
2k views

Deep Format of a Harddrive on a Linux System

I've got an original Asus Eee PC Netbook that I'd like to sell. When I've sold old computers in the past, I've typically done a deep/secure/zeroing out style format. How can I do this on a Linux ...
0
votes
0answers
3k views

Aftermath of Hack

We recently faced a full scale attack on one of our servers running Open SUSE 11.0; the intruder deleted a lot of files necessary for day to day operation. Although the backups came in handy but for a ...
72
votes
7answers
27k views

Heartbleed: how to reliably and portably check the OpenSSL version?

I was looking at a reliable and portable way to check the OpenSSL version on GNU/Linux and other systems, so users can easily discover if they should upgrade their SSL because of the Heartbleed bug. ...
10
votes
3answers
1k views

Apache: Scammers point dozens of domain names at my dedicated IP. How to prevent this?

For the sake of discussion, pretend that I have an Apache webserver which serves a website at www.example.org. This domain name resolves to the public IP address at 192.168.1.100 (pretend this is a ...
59
votes
13answers
28k views

What steps do you take to secure a Debian server?

I am installing a Debian server which is connected directly to the Internet. Obviously I want to make it as secure as possible. I would like you guys/gals to add your ideas to secure it and what ...
35
votes
10answers
12k views

Securing a fresh Ubuntu server [closed]

Say I've got a fresh install of Ubuntu, what steps should I take to secure it for use as a Rails application server?
10
votes
7answers
11k views

How to log every linux command to a logserver

I want every single command typed to go to a logserver. Already configured is the syslog-ng to send all logs to the logserver. I'm interested in any and all methods to do this. I would expect ...
14
votes
1answer
1k views

How to do a post-mortem of a server hack

I have a Windows Server 2003 SP2 machine with IIS6, SQL Server 2005, MySQL 5 and PHP 4.3 installed on it. This is not a production machine, but it is exposed to the world via a domain name. Remote ...
15
votes
9answers
11k views

Live view of Linux shell commands executed by another user?

Is it possible for the root user in Linux to have a real-time (or close to real-time) view of the shell commands being run by another user logged in via a terminal or SSH? Obviously they're stored in ...
11
votes
3answers
30k views

Iptables: How to allow only one ip through specific port?

How can I on my ubuntu server, in Iptables only allow one IP adress on a specific port? Thanks
21
votes
4answers
10k views

REJECT vs DROP when using iptables

Is there any reason why I would want to have iptables -A INPUT -j REJECT instead of iptables -A INPUT -j DROP
7
votes
6answers
3k views

What resources are best for staying current about information security? [duplicate]

What types of sites do you visit, on a regular basis, to stay current on information security issues? Some examples from my list include: http://isc.sans.org/ http://www.kaspersky.com/viruswatch3 ...
10
votes
4answers
697 views

Updating Malware cleaning skills

I have seen some sites offering 'Malware University', training classes on getting rid of malware. Do you think that updating your malware removal skills (or arsenal) is necessary from time to time? ...
17
votes
5answers
11k views

Does fail2ban do Windows?

Can anyone recommend a fail2ban-like tool for a Windows OS? I've got a couple of Windows Media servers that get hammered with brute force authentication attempts. I would like to plug these ...
16
votes
19answers
3k views

How should I securely wipe data from a hard drive?

How do you recommend destroying sensitive information on a hard drive? I've used DBAN in the past, is that good enough?
9
votes
6answers
4k views

How can I log users' bash commands?

I'm running a debian etch server where users will be logging into (hopefully) a chroot jail through ssh. How can I have the commands they execute logged in a way they cannot delete, nor prevent?
5
votes
9answers
3k views

What is the best Antivirus for a Windows Domain Network? [closed]

What is the best Antivirus for a Windows Domain Network?
260
votes
3answers
253k views

What is a Pem file and how does it differ from other OpenSSL Generated Key File Formats?

I'm pretty much a n00b at system administration and I am responsible for maintaining two Debian servers. Every time I have to do anything with security certificates, I google for tutorials and beat ...
83
votes
6answers
26k views

SSH keypair generation: RSA or DSA?

SSH supports two signature algorithms for key pairs: RSA and DSA. Which is preferred, if any? For RSA, what is the minimum acceptable key length?
23
votes
2answers
49k views

How can I allow one user to su to another without allowing root access?

I'd like to allow certain users to su to another user account without having to know that account's password, but not allow access to any other user account (i.e. root). For instance, I'd like to ...
14
votes
6answers
3k views

How difficult is it to setup a mailserver?

I want a secure mail solution, as I am looking to move away from Google and other parties looking into my private data. How much of a PITA is it to setup my own mailserver? Should I go for an ...
13
votes
2answers
2k views

Auto-booting and Securing a Linux Server with an Encrypted Filesystem

I'm setting up some new Ubuntu servers, and I'd like to secure the data on them against theft. The threat model is attackers desiring the hardware or rather naïve attackers desiring the data. ...
22
votes
5answers
2k views

Avoid to keep command in history

I use bash and I would like to avoid some commands being kept in the history. Is it possible to do that for the next command only? Is it possible to do that for the entire session?
13
votes
3answers
1k views

Log every command executed from root

I want to give access to my root server to an external system administrator, but i want to be sure to double check what he is doing to my server, e.g. copying data i don't want them to do and so on. I ...
14
votes
2answers
778 views

how do i perform root actions from non-root account?

I want to be able to restart services from a php-script. running under the www-user account. What's the preferred way to perform these actions? I recon I can place create a file with que'd commands, ...
16
votes
7answers
13k views

Monitor an incoming SSH session in real time

Is there any linux software to monitor an incoming ssh session. At a previous job I was told that if you ever needed support from Red Hat for example you could have them SSH into your machine and you ...
8
votes
12answers
1k views

Securing SSH server against bruteforcing

I have a little SVN server, old dell optiplex running debian. I don't have that high demands on my server, because its just a little SVN server... but do want it to be secure. I just renewed my ...
25
votes
8answers
17k views

My server is still vulnerable to heartbleed even after I update OpenSSL

I have an Ubuntu 12.04 server. I have updated the OpenSSL package in order to fix the heartbleed vulnerability. But I am still vulnerable even, even though I have restarted the web server, and even ...
8
votes
7answers
486 views

Keeping up with security

After some comments made to another question, I wonder how many administrators actually go to websites like Packetstorm? Do you keep up to date with the latest threats coming out? Finally what are the ...
4
votes
2answers
2k views

SYN Flood Advice

Today I've been dealing with a server suffering from what looked like a SYN flood attack. It was a bit of a rush to get the site back online, so we did these three steps to bring the service back to a ...
37
votes
2answers
4k views

Why do I have to edit /etc/sudoers with visudo?

I've noticed that the sudoers file and cron config files act in a special way compared to other config files on Linux. They need to be edited with a special wrapper rather than any text editor. Why is ...
12
votes
6answers
5k views

How would you send syslog *securely* over the public Internet?

So I've got a few servers which I'd like to log centrally but obviously I don't want to pass the data insecurely over the internet. I've tried syslog-ng but can't make it work in a secure way, a ...