Security is not a product, but a process.

learn more… | top users | synonyms (1)

3
votes
4answers
3k views

WMI permissions: Select CommandLine, ProcessId FROM Win32_Process returns no data for CommandLine

I am gathering performance data via WMI and would like to avoid having to use an account in the Administrators group for this purpose. The target machine is running Windows Server 2003 with the latest ...
0
votes
0answers
57 views

Restricting NetBIOS Access

There is a Windows Server in the domain. It has folders NetBIOS shares for users to access. It also plays the role of Remote Desktop via RDP. How can I keep all of these services advertised but ...
0
votes
0answers
20 views

A domain controller in Azure ends up public on the Internet with no firewall - is it compromised? [duplicate]

I'm helping a customer stand up an Azure environment and they decided to stand up a server (DC) on their own without asking for help. The only access method is supposed to be IPsec, but they forgot ...
0
votes
0answers
17 views

Wordpress Access Logs

I've recently had a wordpress site compromised and the www-data user was able to create new files in the webroot. After looking at the apache acess logs I've found the following request which seems a ...
-7
votes
1answer
122 views

SysWOW64 access denied (Windows Server 2012 Standard) [closed]

I am trying to call: [System.IO.File]::Delete($folder) from the Powershell ISE (not ISEx86). I am logged in as Domain User that is an Administrator on this machine to which I connect using RDP. I ...
2
votes
0answers
35 views

Apache 2.4.20 and “SeverTokens Prod” causes “segmentation fault”

Simply stated I am running Apache 2.4.20 on CentOs 6 and am in the process of hardening this VM prior to rolling it out. I added this line: ServerTokens ProductOnly Which on restart promptly gave ...
-1
votes
1answer
34 views

How do I execute monit commands from a shell script without root access?

I've installed and configured monit on a Debian server and opened the http service to localhost and gave rw permissions to the group "monit". I created this group and added myself to this group. The ...
5
votes
3answers
3k views

How found suspect connection in a netstat output?

It seems some ssh brute force are outgoing from my debian 7.1. I'm searching how to find the source of these brute force. I'm searching in netstat output, but how can i identify trace of this hack ? ...
0
votes
2answers
51 views

Is there a way in Linux where one non root user can check if another non root user is using OpenSSL or not without sudo permission?

Consider this scenario where User-A and User-B are both non-root user are running inside a server. User-A is running different Program P1 (pid-2814),P2(pid-2815) whereas User-B is running different ...
0
votes
1answer
3k views

Open port 8009/tcp on Fortigate necessary?

A nmap scan of a Fortigate Firewall showed that TCP port 8009 open is. According to knowledge base articles this is only to download the client for ssl vpn. Is this port used for anything else, and if ...
0
votes
2answers
429 views

How to prevent password expiration in apache Archiva

I am running a standalone Archiva 2.2.0 installation. I added security.properties file to ~\conf directory. In security.properties I defined: security.policy.password.expiration.days=999999 ...
5
votes
2answers
4k views

Iptables - Redirect outbound traffic on a port to inbound traffic on 127.0.0.1

Is there a way to redirect traffic set to go out of the server to another IP, back to the server on localhost (preferably as if it was coming from the original destination)? I'd basically like to be ...
1
vote
1answer
1k views

Network Services Write/Modify Permissions on Inetpub Folder Potiential security issues

I have an asp.net web application that runs as a Content Management system for a website. It was originally on an IIS6 Server. However the web application was recently moved to an II7 Server. After ...
8
votes
1answer
1k views

certutil -ping fails with 30 seconds timeout - what to do?

The certificate store on my Win7 box is constantly hanging. Observe: C:\>1.cmd C:\>certutil -? | findstr /i ping -ping -- Ping Active Directory Certificate Services Request ...
1
vote
1answer
9k views

Error 4673 audit failure filling security logs

I have an isolated desktop computer in my office that I run weekly security audits on. I check the logs for odd behavior then export and clear them out. The logs are filled with "Audit failure ...
0
votes
1answer
13 views

System Center 2012 Security

I installed the entire System Center 2012 Suite and I run the Database on it's own machine. During installation I noticed you could use specific user(s) on the install and setup for each of the ...
3
votes
2answers
96 views

Secure Email Settings for Email Clients & for PHPMailer

I'm trying to work out how to make my outgoing/incoming email's as secure as I can possibly make them. First of all, my domain has Wildcard OV SSL Certificates, I have copies of the .csr, .crt and ....
0
votes
1answer
22 views

How to disable systemcalls in ftp environment with vsftpd?

I've set up a vsftpd server with local users jailed within their home directories. Anyhow if I connect through a ftp client I can execute systemcalls with the "!" command. How can I configure vsftpd ...
13
votes
2answers
1k views

Are DNS records private information?

Assuming you wanted to create a subdomain that points to a private location (perhaps the location of a database, or the IP address of a computer you don't want people to attempt SSH-ing into), so you ...
4
votes
1answer
168 views

How to secure a docker host to not allow rooting

I am trying to make docker on a server more secure. The main problem is that most people say "if a person has access to docker, they can be root too" for an administrator point of few this is not ...
8
votes
3answers
7k views

Is there any javascript ssh client?

I mean pure javascript client that uses HTML5 sockets and doesn't need to be installed, just open single js file in browser. Is it possible to write such client at all?
0
votes
0answers
29 views

Does Docker's CAP_NET_ADMIN allow a container to affect the host network, or only it's own?

I have a docker container running a password authenticated SFTP server (client requirement - I've already lost that battle). In order to mitigate the risk of brute force attacks, I had thought to ...
1369
votes
28answers
321k views

Our security auditor is an idiot. How do I give him the information he wants?

A security auditor for our servers has demanded the following within two weeks: A list of current usernames and plain-text passwords for all user accounts on all servers A list of all password ...
-1
votes
1answer
33 views

Restrict a program to only access files in a specific folder not containing it

I have a folder F and a program P outside of the folder F. How to make P only able to access files in F? Answers for any OS are accepted but preferably something that work in Debian. E.g F is ~/...
1
vote
0answers
35 views

Someone Uploaded PHP Backdoor to Wordpress Site [duplicate]

I have enough security that I was alerted to a PHP backdoor that was uploaded to a WordPress site hosted on one of my servers. It was removed within minutes of being uploaded so no damage was done. No ...
-1
votes
0answers
22 views

KVM CPU features security risk or performance benefit

I need to run an untrusted VM with libvirt and KVM and need decent performance. When I run virsh capabilities to see what my CPU can provide, I get: <cpu> <arch>x86_64</arch&...
50
votes
5answers
15k views

How to decide where to purchase a wildcard SSL certificate?

Recently I needed to purchase a wildcard SSL certificate (because I need to secure a number of subdomains), and when I first searched for where to buy one I was overwhelmed with the number of choices, ...
1
vote
1answer
1k views

403 forbidden error going through aws load balancer

I am running a IIS 7 Server behind an aws load balancer. I am using a Verisign SSL certificate which is installed properly but whenever I put in the URL, or the DNS name of the load balancer I get a ...
1
vote
1answer
1k views

Grant NON-administrator privileges to IIS 7

We are implementing a pseudo-Platform as a Service environment. It's a fairly simple set up that parallels Infrastructure as a Service: basically our clients will each have a access to their own ...
0
votes
1answer
33 views

Does the following Apache Webserver configuration block access to all URLs except one?

I am trying to prevent access to my web site except for access to the single URL "/ws/public" that everyone is allowed to view. I am running Apache WebServer in front of an Apache Tomcat which is ...
0
votes
3answers
2k views

Finding outbound connections from Apache/PHP

A client website was recently compromised, and we're analyzing the damage and exposure from the attack. We've found a script that is "calling home" to a URL we can easily find in a log, but is this ...
-2
votes
1answer
25 views

Windows server Allow and deny [closed]

What is the deal with this. According to my count there are for possible permissions allow (checked) deny (checked) not allow (empty) deny (checked) allow (checked) deny( empty) allow (empty) deny (...
0
votes
0answers
62 views

Site unreachable due to attack - xmlrpc.php

Today our server was not reachable. It was returning a 502. We are running Nginx 1.10 on Ubuntu 14.04. We also use PHP7 (only, no PHP5). In the logs, we got the same error from the same client (2 ...
2
votes
10answers
4k views

Is it worth blocking hackers' IP addresses?

A Chinese IP address shows up in our logs as accessing one of our surveys but it stands out because the user tried adding a string to the end of the survey's URL (as if trying to perform a SQL ...
0
votes
0answers
11 views

activate geoip settings when certain locations detected

I have a website that is attacked from time to time by ddos attackers. Such attack can disable the webpage for days. The webpage serves for few countries so if I know about the attack, the solution is ...
19
votes
3answers
14k views

Is the PHP option 'cgi.fix_pathinfo' really dangerous with Nginx + PHP-FPM?

There has been a lot of talking about a security issue relative to the cgi.fix_pathinfo PHP option used with Nginx (usually PHP-FPM, fast CGI). As a result, the default nginx configuration file used ...
0
votes
1answer
51 views

Network maps, best admin practises and how them saved your ass?

I am reviewing the security of a (quite large) network. There are a some thousands switches, several hundred routers, several hundred access points, tenths of FW, IPS, and so on. PCs and servers are ...
0
votes
0answers
26 views

Win Server 2003, security permissions are reset by SYSTEM. Why?

I've got a Windows Server 2003 with a physical drive (let's say Z:/) It's shared within my company. In the past two days the users were complaining that they do not have access to files on that drive. ...
1
vote
0answers
32 views

Install Mod_Security for Nginx without need to recompile

I've got LEMP all setup. Now I would like to add mod_security. I tried to research but all I could find are instructions on how to recompile nginx. Is there a way to add mod_security without needing ...
1
vote
1answer
46 views

Digital signature with openssl

I am trying to sign and verify a signature using an RSA key-pair. Here is how I generate the key pair (which work fine for encryption / decryption): ssh-keygen -t rsa -f mykey -N '' -b 2048 mv ...
4
votes
8answers
69k views

Are there any RDP activity logs? - Windows Server 2008 R2

a few users have logged into a server through RDP. I would like to monitor activity, but do not know my way round Windows Server that well. I am hoping there are logs of some kind around that I can ...
4
votes
2answers
1k views

Auditctl - filtering out cron messages

Im using auditctl and get a lot of logging events for crond. I do not wish to log any cron/crond events. node=127.0.0.1 type=CRED_DISP msg=audit(1405678801.149:5571): user pid=1757 uid=0 auid=0 ...
9
votes
1answer
112 views

Where and how is the password stored for the account associated with a Windows service?

In HKLM\SYSTEM\CurrentControlSet\Services\MY-SERVICE-NAME there is the Object Name key which contains the name of the user, but I can not find the password. I am trying to understand how DP API ...
11
votes
6answers
33k views

What permissions / ownership to set on PHP Sessions Folder when running FastCGI / PHP-FPM (as user “nobody”)?

I'm having trouble getting a number of scripts running because PHP-FPM can't write to my session folder: "2009/10/01 23:54:07 [error] 17830#0: *24 FastCGI sent in stderr: "PHP Warning: Unknown: ...
0
votes
1answer
111 views

Weak points of ssh tunnel and x11 server, hack investigation

So, today I've been hacked. It's very puzzling to me how it was done, so I'm looking for experienced people to show weak points in design of my systems. I have two servers. One is VPS with ...
0
votes
0answers
29 views

Zentyal - Samba Issue : A logged in user cannot access home folder

0 down vote favorite I have a very strange issue : I can login to my domain with my username/password and when i try to access my home folder (lets say \Knosos\myname ) i receive an access denied ...
1
vote
1answer
34 views

Secure AD Access

I was just trying to access and Active Directory-Server via php (ldap) to be able to use Windows credentials for a Website Login. I did this using xampp on my standard Windows connecting to a Windows ...
0
votes
0answers
55 views

How do I require a sudo password on Google Compute Engine instances?

The default configuration of Google Compute Engine instances allows administrators to run all commands via sudo without specifying a password. This seems like a security weakness, because the theft of ...
1
vote
3answers
699 views

Erase Sharp Printer Hard Disk?

I have a number of Sharp MX-M550 printers that are at the end of their useful life. Each device has a hard disk. Can anyone advice as to how I go about erasing the drives either whilst they're in ...
1
vote
1answer
53 views

We've had a ransom-ware attack - looking for help/advice

I've recently started working in a small subsidiary of a larger international organisation. My work is on the help desk, and there's 3 developers on the team, and our boss is the manager and acting ...