Security is not a product, but a process.

learn more… | top users | synonyms (1)

1
vote
0answers
410 views

Nginx error: “File not found”…coming from someone else's domain

I set up nginx to serve from an Ubuntu EC2 instance a few days ago, and today I checked the error logs when I encountered 504 after 504 in the browser. I found the following in my error.log: ... ...
0
votes
1answer
17 views

Data security for PII

I have a question regarding data security. I have an application that dumps a flat Excel file on a Windows server from an SAP database. The file is edited, then the application writes the edited ...
-1
votes
0answers
19 views

Fail2Ban is not working for ssh

Iptable status:- ubuntu@ip-address:~$ sudo iptables -S -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -N fail2ban-ssh -A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh -A fail2ban-ssh -j ...
2
votes
2answers
2k views

Windows GPO Software Restrictions Policy not working with %TEMP% variable

I'm trying to put in some meagre additional malware prevention measures, by restricting the execution of *.exe in a handful of locations -- in particular, the temporary folders that various ...
-1
votes
0answers
23 views

Snort alerts analysis (web interface)

I have a question about Snort (or maybe any other IDS/IPS, any working solutions would be ok). The goal is to set up some web interface providing a way to view the whole TCP stream packets of each ...
-3
votes
1answer
33 views

Windows File Shares inside an Organisation [closed]

I came across to a security weakness that potentially can put information at risk in my organisation. Whenever I access other's computer in the network through the command: \\192.168.20.4\c$ I ...
1
vote
2answers
43 views

How do I drop requests from dig?

Basically I'm getting tons of request to my named/bind service, basically those requests are being rejected by named, Those are the messages i get, from tons of ips., How extacly can I drop those ...
3
votes
1answer
34 views

Restrict postqueue access to admin user

I'm running postfix on Gentoo as mailer daemon. During investigation of some queue pileup I found that /usr/sbin/postqueue is executable by all users on the system, it happily outputs the current mail ...
0
votes
2answers
38 views

Protecting mysql instance on Linux Azure VM

I have mysql running in a Linux Azure VM. It's currently bound to the "Internal IP Address" of the VM as looked up in ifconfig and the Azure Dashboard. I've turned on logging to see who and what is ...
2
votes
2answers
38 views

Does DNSSec NSEC3 require support from the Registrar, DNS Server or both?

I'm interested in getting NSEC3 support for my domain getvalid.com, so that I can prevent name traversal. DYN doesn't seem to support NSEC3, and it's clear that BIND and the DNS server require the ...
1
vote
1answer
3k views

Error 4673 audit failure filling security logs

I have an isolated desktop computer in my office that I run weekly security audits on. I check the logs for odd behavior then export and clear them out. The logs are filled with "Audit failure ...
1
vote
2answers
2k views

windows 2008 R2 TS printer security - can't take owership

I have a Windows 2008 R2 server with Terminal server role installed. I'm seeing a problem with an ordinary user who is member of local printer operators group on the server. If the user opens a cmd ...
-1
votes
0answers
78 views

Server hacked; how? [duplicate]

It looks as if our CentOS LAMP server has been compromised today. It appears malicious files have been uploaded into the webroot and requests are being made to upload these files to other servers. I ...
15
votes
1answer
16k views

How to inspect remote SMTP server's TLS certificate?

We have an Exchange 2007 server running on Windows Server 2008. Our client uses another vendor's mail server. Their security policies require us to use enforced TLS. This was working fine until ...
1
vote
0answers
18 views

Managing IAM security credentials for multiple docker containers

Within plain EC2 environment, managing access to other AWS resources is fairly straightforward with IAM roles and credentials (automatically fetched from instance metadata). Even easier with ...
0
votes
1answer
2k views

Open port 8009/tcp on Fortigate necessary?

A nmap scan of a Fortigate Firewall showed that TCP port 8009 open is. According to knowledge base articles this is only to download the client for ssl vpn. Is this port used for anything else, and if ...
10
votes
2answers
14k views

How to check if a RSA public / private key pair matched

I have two files, id_rsa and id_rsa.pub, what command can be used to validate if they are the valid pair.
-2
votes
1answer
61 views

How to secure OwnCloud? [closed]

I am not literate when it comes to servers, but I like the idea of having my own cloud storage for privacy reasons. OwnCloud is targeting (at least a little bit) the "DIY-home-user" so it seemed to be ...
4
votes
2answers
1k views

How found suspect connection in a netstat output?

It seems some ssh brute force are outgoing from my debian 7.1. I'm searching how to find the source of these brute force. I'm searching in netstat output, but how can i identify trace of this hack ? ...
1
vote
1answer
1k views

Disabling weak ciphers

Does anyone have any experience disabling weak ciphers on Windows Registry? Server doesn't have IIS installed. Below is the results of my security scan but not 100% what registry entries should be ...
5
votes
1answer
1k views

certutil -ping fails with 30 seconds timeout - what to do?

The certificate store on my Win7 box is constantly hanging. Observe: C:\>1.cmd C:\>certutil -? | findstr /i ping -ping -- Ping Active Directory Certificate Services Request ...
0
votes
1answer
1k views

Enabling cipher TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) on Windows Server 2003+ISA 2006

I have been given a task to disable all "weak" ciphers/protocols on our very old ISA server based on Windows Server 2003. I have disabled all protocols but TLS1.0, and all ciphers but RC2/128, RC4/128 ...
0
votes
0answers
16 views

Warnings in Tiger auditing reports (process is listening on socket)

I get email logs like the ones below emailed daily from my server. I don't really know what does it mean and thinking about disabling them, but I guess this is not a good idea and it's better to learn ...
14
votes
7answers
4k views

Should I bother to block these rather lame attempts at hacking my server?

I'm running a LAMP stack, with no phpMyAdmin (yes) installed. While poking through my Apache server logs I noticed things like: 66.184.178.58 - - [16/Mar/2010:13:27:59 +0800] "GET / HTTP/1.1" 200 ...
0
votes
2answers
1k views

Passed SSL checker, but browser doesn't show secure?

I've set up my SSL certificate following the instructions at http://splittingelectrons.wordpress.com/2012/02/24/how-to-configure-an-ssl-certificate-for-apache-on-amazon-ec2/ I've checked my website ...
0
votes
2answers
45 views

Disable ssh login on specified time for particular users

I would like to disable ssh login to my system for particular users say X,and Y on specified time 17.00 to 18.00. so how to achieve this ? any help would be appreciated.
1
vote
2answers
50 views

Where are MySQL users and passwords stored?

When I delete 'mysql'.'user' table I'm still able to log in as any user I've created before. How is this possible?
0
votes
2answers
1k views

Disabled IPV6 but still showing in netstat

newbie here, for security best practice I want to disable IPV6 (not to deal with IPV6 firewall settings). I use Hetzner root server Ubuntu 12.04 . /etc/sysctl.conf file already have a setting from ...
8
votes
9answers
4k views

What should I do about someone trying to brute force attempt to login to our SQL Server 'sa' account?

Looks like someone or something is trying a brute force attempt at logging into our production SQL Server instance with the 'sa' account. They haven't been successful because our 'sa' account is ...
0
votes
1answer
64 views

Blocking SSH Brute force from a HAProxy LB

We're trying to grant access to an internal SSH server using a HAProxy setup on a public DMZ. This works as expected however connections into the server are originated from the HAProxy (tproxy won't ...
0
votes
1answer
1k views

How to enable connection security for WMI firewall rules when using VAMT 2.0?

I want to use VAMT 2.0 to install product keys and active software in remote machines. Everything works fine as long as the ASync-In, DCOM-In, and WMI-In Windows Firewall rules are enabled and the ...
0
votes
1answer
1k views

Most secure: Authentification point at Citrix Access Gateway, or Web Interface

At our company we have XenApps accessible through Citrix Access Gateway. I am looking through the settings and i can see under the Web Interface settings that the authentication point is set to be "at ...
1
vote
1answer
901 views

Limit simultaneous call per user in Asterisk

I want to limit simultaneous calls per extensions in Asterisk for security reasons. For example when a user is on the call no body else would be able to make a call by that extension. How can I ...
2
votes
3answers
212 views

Need a recipe following a hack disaster [duplicate]

I have inherited a Linux Apache CentOS plesk server which has been hacked, which has websites which are in production. I have been advised by my friend to rebuild it from scratch, since the attack ...
1
vote
5answers
2k views

Server Potentially Compromised — c99madshell [duplicate]

So, low and behold, a legacy site we've been hosting for a client had a version of FCKEditor that allowed someone to upload the dreaded c99madshell exploit onto our web host. I'm not a big security ...
0
votes
0answers
20 views

LDAP Browser(Softerra) vs LDP.exe

Here is the issue; -> There is a Deny All(FullControll) set on 2 OUs for a service account. -> When i use LDP.exe to query those OUs, it can read their names but can not display any objects ...
11
votes
4answers
8k views

Is there a windows equivalent to chroot?

On a *nix system I can use a chroot to isolate 2 processes from each other and from the rest of the system. Is there any similar security system under windows? Or is there any way to prevent 2 ...
-2
votes
1answer
42 views

What are the security risks associated with an automated login script?

I have a remote server that only allows logins through a browser https request. I want to download images from it, and cache them and use them in a local job. What are the security risks with ...
-1
votes
1answer
38 views

DHE cipher suite issue

I am now using this cipher suite: SSLCipherSuite ...
0
votes
0answers
19 views

How do I ban IP's that request files that do not exist using fail2ban? [duplicate]

I have recently started using Fail2Ban and need to configure a specific 'Jail'. My apache error logs are filled with requests for files within my /var/www folder. The folder doesn't contain any ...
2
votes
3answers
256 views

Rebuild or repair? [duplicate]

Possible Duplicate: Updating Malware cleaning skills I was having an argument the other day regarding damaged systems. If a system has a hard to eradicate virus, etc, or has been damaged ...
12
votes
3answers
19k views

What is muieblackcat?

I've recently installed ELMAH on a small .NET MVC site and I keep receiving error reports System.Web.HttpException: A public action method 'muieblackcat' was not found on controller... This is ...
1
vote
0answers
21 views

Strange file structure on surveillance DVR

I have a 2TB HDD (WD Purple) from a client's surveillance DVR (Night Owl) with a puzzling file structure. The drive has 7,451 256MB files all dated 1/10/2098 23:02. The files are named 0001-7451 with ...
0
votes
1answer
915 views

SQL Server NETWORK SERVICE account permissions

My SQL Server Windows service is set to use the NETWORK SERVICE account. The server is installed to C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL. However looking at the ...
4
votes
2answers
85 views

should anonymous access to the IPC share be allowed on Windows 2008 r2

During an audit the question of anonymous access to the IPC$(null sessions) share was raised. The audit lists the following as being a risk on a Windows 2008r2 file server: C:\>net use ...
0
votes
2answers
45 views

Asterisk new PJSIP driver security option

I have a working asterisk environment, but I get a lot of unwanted traffic, like sip scanners of people who even try to call as a guest. I'm using res_pjsip, the configuration is stored in ...
0
votes
2answers
252 views

Retrieve malicious IP addresses from Apache logs and block them with iptables

Im trying to keep away some attackers that try to exploit XSS vulnerabilities from my website, I have found that most of the malicious attempts start with a classic "alert(document.cookie);\" test. ...
4
votes
1answer
2k views

Force SSH public key authentication for specific users

Is it possible to force specific users to login with public key, while allowing other users to login with password? Since public key authentication (with passphrase) is stronger than password-only ...
0
votes
2answers
93 views

Can't get rid of Apache server-status

I am trying to deactivate the /server-status from an Apache2 running on a Fedora server. I tried to comment the lines in /etc/httpd/conf/httpd.conf and I also tried to make it work only for my IP ...
0
votes
0answers
12 views

recieved abuse complaint that badbot came from my ip [duplicate]

I recieved an abuse complaint that a badbot was used to attack their servers and the badbot listed my ip as the source. Does this mean that my server is infected and using my server to send out ...