Security is not a product, but a process.

learn more… | top users | synonyms (2)

0
votes
1answer
37 views

How to block server's internet access and only allow LAN [closed]

I was wondering what the best way to block a server's internet access is while allowing LAN connections. Essentially, I want a server to be only accessible by LAN. What ips, ports, etc should I block? ...
1
vote
1answer
39 views

How can I let nginx log the used SSL/TLS protocol and ciphersuite?

My goal is to ensure proper security for clients connecting to my nginx. I'm following Mozilla's guide to configure TLS properly on my nginx installation, but I don't have an overview of the actual ...
3
votes
3answers
453 views

Nagios Hardening

I've been trying to look into hardening Nagios (if there is such a thing...), but haven't found anything too definitive on what to do or guidance on what to even look at. I'm wary to keep Nagios ...
0
votes
1answer
42 views

Securing MySQL debian-sys-maint

With a fresh (but old) install of Ubuntu and MySQL, I found I could access the MySQL via command line client without being asked for any user or password. This bothered me as the default situation, ...
1
vote
2answers
157 views

Watchguard Firebox “split” fibre optic line into 2 interfaces

We have a requirement on our Watchguard Firebox XTM505 to be able to split our incoming external interface, in this case a fibre optic dedicated leased line, 100/100. We use the line in our office of ...
0
votes
5answers
112 views

Should I change the SSH port to < 1024? [duplicate]

Many server configuration guides recommend that the SSH port should be changed to something > 1024, for obscurity and to avoid conflicts. This is interesting, because it recommends using a port < ...
1
vote
0answers
29 views

Disabling HSTS for managed browsers

What are my options for disabling HSTS both for new sites and for those sites baked into the browser? The use of HTTPS inspection inherently changes the thumbprint of a site by acting as a man in ...
2
votes
4answers
6k views

nmap on my webserver shows TCP ports 554 and 7070 open

I have a webserver that hosts various websites for me. The two services that are accessible outside are SSH and Apache2. These are running on a non-standard and standard port, respectively. All other ...
9
votes
2answers
408 views

How to handle security updates within Docker containers?

When deploying applications onto servers, there is typically a separation between what the application bundles with itself and what it expects from the platform (operating system and installed ...
6
votes
4answers
405 views

Security of Apache DocumentRoot

I have a general question about security of Apache DocumentRoot, which comes from a statement I read when installing Galaxy, a bioinformatic web service and infrastructure. The statement says ...
1
vote
1answer
35 views

What are (if any) possible scenario whereby hacker can find multiple sites hosted in one VPS?

Let me clarify: Say that I have 10 sites hosted in one VPS host. And for some reason, one of these sites gets famous and a hacker wants to know where it is hosted, and how many other sites are hosted ...
-2
votes
1answer
75 views

Is the Datadog install script safe to run? [closed]

I have a production server (CentOS 6, Apache, Nginx, MySQL, PHP, wordpress). I want to see some metrics (e.g., load bandwidth, RAM, CPU and so on). I chose a Datadog for this task. The instructions ...
2
votes
1answer
44 views

The ipmitool conundrum

We have been trying to migrate to a better password management system on our server. The problem was that all this days we were using a proprietary algorithm to create a hash (a decryptable hash). In ...
1
vote
1answer
149 views

Strange Entry in Access Log of Apache [closed]

I got a strange in apache access_log 117.86.199.18 - - [27/Jul/2014:10:42:10 +0200] "GET http://hotel.qunar.com/render/hoteldiv.jsp?&__jscallback=XQScript_4 HTTP/1.1" 302 256 It looks that ...
20
votes
8answers
2k views

Restrict a Linux user to the files he owns

Imagine a server setup of a shared webhosting company where multiple (~100) customers have shell access to a single server. A lot of web "software" recommends to chmod files 0777. I'm nervous about ...
1
vote
2answers
1k views

Lotus Notes Access Logs - Where are the Logs found in Domino?

Where are the logs found in Domino? In particular, I am looking for access (login access times and IP address) logs for Lotus Notes web mail. Is it possible to view who logged in to a user's mailbox ...
1
vote
0answers
48 views

Apache 2.4/PHP-FPM ProxyPassMatch and access restriction

I've got Apache/PHP setup exactly like this: https://wiki.apache.org/httpd/PHP-FPM It includes the ProxyPassMatch rule as mentioned: ProxyPassMatch ^/(.*\.php)$ ...
0
votes
1answer
774 views

Nginx : Proper use of limit_req_zone and limit_req

I have 2 website running on VPS. Their purpose is sharing music files and publishing news. Both of them use wordpress. What I am trying is that I want to prevent little hackers from flooding the ...
0
votes
0answers
4 views

Why/when does creating a mysql trigger require SUPER privileges? [migrated]

I'm attempting to parse and understand what the MySQL doc says about when SUPER privileges are required for creating triggers. They say: If binary logging is enabled, CREATE TRIGGER might require ...
0
votes
1answer
50 views

Authorizing users to SSH into machine - where to configure?

Ubuntu Trusty here. I'm having some trouble deciding where in the system I should configure which users are to be allowed to ssh into the machine, and which keys they're allowed to use. I've ...
2
votes
2answers
312 views

EC2 & MySQL security

The current infrastructure contains two servers located in Amazon EC2: application server, and MySQL server. Concern: security of communication between the application server and the database, ...
26
votes
3answers
2k views

Is it safe to reboot a server open to the internet?

Specifically I have an iptables ruleset defined on a server running CentOS. Am I guaranteed / can I guarantee / how can I guarantee that when networking comes online (either at machine boot, or after ...
0
votes
2answers
51 views

Remote login terminal

I have an unusual request. I have a box - running Fedora 19 - that I'm using as a server. I have a crappy Atom netbook - also running Fedora - that isn't good for anything. I was wondering if there is ...
0
votes
1answer
1k views

Open port 8009/tcp on Fortigate necessary?

A nmap scan of a Fortigate Firewall showed that TCP port 8009 open is. According to knowledge base articles this is only to download the client for ssl vpn. Is this port used for anything else, and if ...
2
votes
1answer
50 views

Advanced Audit Policy not getting applied on 2012 R2

I have configured several avanced audit policy settings under: Computer Configuration => Policies => Windows Settings => Security Settings => Advanced Audit policy Configuration => ...
1
vote
2answers
804 views

Windows GPO Software Restrictions Policy not working with %TEMP% variable

I'm trying to put in some meagre additional malware prevention measures, by restricting the execution of *.exe in a handful of locations -- in particular, the temporary folders that various ...
1
vote
1answer
710 views

403 forbidden error going through aws load balancer

I am running a IIS 7 Server behind an aws load balancer. I am using a Verisign SSL certificate which is installed properly but whenever I put in the URL, or the DNS name of the load balancer I get a ...
0
votes
1answer
45 views

Should I still disable root if I disable password authentication and enable only key authentication?

I'm new to the linux world and I've been reading a few tutorials on security. I've seen some questions on StackExchange tackling this subject, but from what I've seen, none of the answers clarified ...
3
votes
2answers
869 views

Applocker vs Software restriction policy

The goal is to prevent users from running unwanted programs on a terminal server. I have read many articles from Microsoft and others saying that the new Applocker feature is 100% better than the ...
5
votes
7answers
650 views

Identifying changed files on *nix webserver

Looking for some (*nix) software which will build an index of "interesting" files on a server and notify when certain of those files contents are modified, or new files appear. Similar to rkhunter et ...
1
vote
4answers
559 views

GLSA-check for Ubuntu or Debian?

glsa-check is a tool to report a server's exposure to known security vulnerabilities. Has anyone written a tool to do a similar thing for apt based systems?
4
votes
5answers
21k views

How can I know when a file was last read or accessed on Windows?

I need to determine if a particular file was accessed in the last, say, 2 days. Is this possible on Windows Server 2008 R2?
1
vote
2answers
790 views

Problem with testsaslauthd and kerberos5 (“saslauthd internal error”)

The error message “saslauthd internal error” seems like a catch-all for saslauthd, so I’m not sure if it’s a red herring, but here’s the brief description of my problem: This Kerberos command works ...
2
votes
3answers
87 views

Is there any point securing a “guest” wifi network with WPA?

We have a guest wifi network setup on a separate VLAN, using an open connection (e.g. NO wpa/wep). A (semi-technical) customer recently complained that he wasn't happy about his traffic not being ...
1
vote
1answer
101 views

Restricting the network access of Docker container

I'm in the process of creating an SFTP only Docker container, one that will be used by multiple people for the sole purpose of uploading and managing files in their own Chrooted Environment. On ...
0
votes
1answer
22 views

Interpreting ** RABHIT ** logs - Potential Attak - SYN?

I am hosting a web on a Linux - Debian Wheezy x64. Our Web Server is LiteSpeed using APF-Firewall and DDoS-Defeat Recently, we are getting logs of below sort, telling us it may be a potential ...
0
votes
1answer
67 views

Installing VirtualBox and restricting NAT and Bridged Network Adapters for Corporate Security

I work as a developer in a security heavy finanical services company. As a group we are finding that our Windows 7 workstation security policy is preventing us from performing our jobs. We do not ...
0
votes
0answers
36 views

Who or what is writing suspicious files in /tmp [duplicate]

Some hacker has managed to poke around enough to write files to my /tmp directory on a hardened CentOS 6 web server box. As far as I can tell they haven't succeeded in anything other than writing ...
0
votes
1answer
24 views

nginx not showing internal at directory

Below is my nginx configuration file. It should make /inc and /admin/inc internal, but I can access them normally, like the line doesn't even exist. It's not giving me a 404 for external requests like ...
2
votes
2answers
670 views

Distribution/setup for shared web hosting

I'm currently administrating a Gentoo server hosting a few dozen websites for friends and people with common interests. I may be moving to a new server soon, and with that comes the possibility to ...
14
votes
6answers
3k views

Should I bother to block these rather lame attempts at hacking my server?

I'm running a LAMP stack, with no phpMyAdmin (yes) installed. While poking through my Apache server logs I noticed things like: 66.184.178.58 - - [16/Mar/2010:13:27:59 +0800] "GET / HTTP/1.1" 200 ...
260
votes
3answers
254k views

What is a Pem file and how does it differ from other OpenSSL Generated Key File Formats?

I'm pretty much a n00b at system administration and I am responsible for maintaining two Debian servers. Every time I have to do anything with security certificates, I google for tutorials and beat ...
1
vote
3answers
2k views

WMI permissions: Select CommandLine, ProcessId FROM Win32_Process returns no data for CommandLine

I am gathering performance data via WMI and would like to avoid having to use an account in the Administrators group for this purpose. The target machine is running Windows Server 2003 with the latest ...
0
votes
0answers
33 views

Setting up muli-project web development server

I'm trying to set up a development server that will be used for several (web) projects by different teams (consisting of different people, some of which may be involved with more than one project). I ...
0
votes
2answers
363 views

secure synchronization of large amount of data

I need to automatically mirror a large amount (terabytes) of files in two unix machines over a slow link (1 Mbps). This needs to be done frequently, but the data doesn't change too much (delta ...
0
votes
0answers
28 views

How do you stop tomcat after changing the shutdown word in server.xml?

Running tomcat-7.0.33 on CentOS. I have a security requirement to change the tomcat shutdown word in server.xml to a random string of characters, so I need to go from this: <Server port="8005" ...
1
vote
1answer
20 views

Microsoft Windows .NET/Visual Studio SDKs installed on production server

We have a variety of SDKs installed on a production Microsoft Windows 2003 SP2 server and I'd like to know if there is any good reason for them to be there, or if they represent a security risk. ...
3
votes
3answers
234 views

How to Limit the Damage of Domain Spoofing

My e-mail account, for my privately run business which I'll call "VeryCoolCompany", is starting to receive bounce-backs for users who don't exist, like these: alan12ab1@verycoolcompany.com ...
17
votes
4answers
10k views

How secure is a bluetooth keyboard against password sniffing?

In a situation where an admin will enter sensitive information into a keyboard (the root password), what is the risk that a bluetooth keyboard (ship by default with Mac systems these days) would put ...
1
vote
0answers
185 views

Hardening Windows Server 2012 r2 for production [closed]

We have some Windows Server 2012 R2 boxes which will be going into production in the next few weeks. Our security guy is telling us to harden the boxes before we do. I am just wondering what people ...