Security is not a product, but a process.

learn more… | top users | synonyms (1)

3
votes
0answers
25 views

MongoDB Oplog Security

We are using a MongoDB replica set for sharing sessions and other (potentially sensitive) data in a web farm. All the data we store uses TTL indexes to expire documents after a relatively short ...
1
vote
1answer
123 views

How to prevent a XenU domain from being saved

Xen (like other) virtual machines allows VMs to be saved and resumed. Xen on Debian Lenny, for instance, is configured to save and resume virtual machines on Dom0 restarts. Is it possible to have ...
3
votes
3answers
2k views

Apache getting hammered by nonsense requests, how to stop?

My VPS is getting hammered with attempts on random files/directories that don't exist on my server, in the order of roughly twice every second. Presumably it's just a bot trying to figure out whether ...
1
vote
1answer
144 views

Which “try_files” nginx directive is best for the zero-day exploit?

So far I have been using the following in the php location of my nginx config files try_files $uri $uri/ /index.php?$query_string; However, I just saw in the Wordpress Codex guide that for the ...
2
votes
0answers
61 views

Stop senseless mass-queries on DNS-server [duplicate]

I have a disturbing problem for a few weeks now ... One of my three DNS-servers (running bind9 as slave of a Plesk DNS master) is getting spammed with senseless DNS requests. The origin IPs of those ...
-1
votes
2answers
26 views

Change Mail Password, leave user system password

I have a Debian Jessie server that provides (web-)mail using postfix, dovecot and roundcube. To log-in to roundcube webmail, I have to use my system user name and password. This seems like a major ...
4
votes
2answers
1k views

How found suspect connection in a netstat output?

It seems some ssh brute force are outgoing from my debian 7.1. I'm searching how to find the source of these brute force. I'm searching in netstat output, but how can i identify trace of this hack ? ...
5
votes
1answer
1k views

certutil -ping fails with 30 seconds timeout - what to do?

The certificate store on my Win7 box is constantly hanging. Observe: C:\>1.cmd C:\>certutil -? | findstr /i ping -ping -- Ping Active Directory Certificate Services Request ...
0
votes
1answer
82 views

CentOS vs Ubuntu Wordpress server security

I am building out a new Wordpress server for a web developer redesigning my companies website. I originally decided to go with CentOS due to stability. However it appears based on the versions of ...
0
votes
1answer
1k views

Most secure: Authentification point at Citrix Access Gateway, or Web Interface

At our company we have XenApps accessible through Citrix Access Gateway. I am looking through the settings and i can see under the Web Interface settings that the authentication point is set to be "at ...
0
votes
1answer
324 views

Event 4625 Audit Failure NULL SID failed network logons

In a small environment comprised of one Windows Small Business Server 2011 server of relatively limited use (domain controller / Active Directory and DNS, Group Policy, DHCP, file server, print ...
0
votes
0answers
16 views

Postfix: rewrite “From” header and Sender Envelope with SASL username [duplicate]

I set up an authenticated mail server, in which a user needs an account to send mail. The SMTP username is the sender's email. The problem is that any authenticated user can send email with any from ...
0
votes
1answer
1k views

Enabling cipher TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) on Windows Server 2003+ISA 2006

I have been given a task to disable all "weak" ciphers/protocols on our very old ISA server based on Windows Server 2003. I have disabled all protocols but TLS1.0, and all ciphers but RC2/128, RC4/128 ...
4
votes
5answers
2k views

How can I make an internet facing TFTP server secure?

I have many Cisco IP phones that operate in the following manner (oversimplified): Negotiate with DHCP for IP, DNS, TFTP, etc. Look for SEPXXXXXXXXXXXX.cnf.xml configuration file on TFTP server ...
0
votes
1answer
10 views

What are the Security Implications of not fully overwriting a fresh LUKS disk prior to use

I recently read this nice Howto tutorial about doing backups with whole disk encryption using LUKS. Surprisingly for me this tutorial contains as the first part of step #3 a command to overwrite the ...
-1
votes
1answer
43 views

Is it a ok wordpress file or is hack, look at this code [duplicate]

I was facing a hack My website is not hosted on a server but shared hosting, If server is hacked I cannot do anything. My Question is not about how to safeguard the server, but is the below code is ...
0
votes
2answers
1k views

Passed SSL checker, but browser doesn't show secure?

I've set up my SSL certificate following the instructions at http://splittingelectrons.wordpress.com/2012/02/24/how-to-configure-an-ssl-certificate-for-apache-on-amazon-ec2/ I've checked my website ...
1
vote
2answers
38 views

OSSEC disk space usage

A few days ago I noticed that the disk of my Ubuntu server was almost full. I dug a bit and found out that the disk space was used by OSSEC, in the /var/ossec/queue/diff folder. I wanted to try ...
0
votes
0answers
36 views

Glassfish 3 unable to deactivate SSL3 for IIOP

I'm running Glassfish 3.1.2.2 and want to disable SSL3 for the IIOP ports (default 3820 and 3920). I set configs.config.server-config.iiop-service.iiop-listener.SSL.ssl.ssl3-enabled=false ...
0
votes
0answers
7 views

WiFi security using IEEE 802.1X - how secure is it? [migrated]

My company's set-up involves a single AP (TPlink) that is configured to authenticate clients using RADIUS. All works well, but: on a regular WPA/WPA2 network, once you have the PSK, you are able to ...
14
votes
4answers
4k views

How to decide where to purchase a wildcard SSL certificate?

Recently I needed to purchase a wildcard SSL certificate (because I need to secure a number of subdomains), and when I first searched for where to buy one I was overwhelmed with the number of choices, ...
0
votes
1answer
184 views

clamscan using maldet Error: Servname not supported for ai_socktype

So i have installed Linux Malware Detect (maldet) to scan a server and everything went fine with installation but when i run it i get an error. Bunch of errors and than the scan just closes it. Here ...
1
vote
2answers
1k views

Blocking repeated http requests in Apache behind a load balancer

I have a number of EC2 servers on AWS running apache behind a load balancer (ELB). Every now and then some IP address abuses the API hosted on the EC2 servers and causes a denial of service. I have no ...
1
vote
1answer
69 views

Fail2ban not starting [WARNING 'findtime' not defined]

It was working fine until i added a new jail [apache-postflood]. If i remove it then it works, so whats wrong with the "findtime" ? . Here's the output: sudo fail2ban-client start WARNING 'findtime' ...
-1
votes
0answers
86 views

How to log uploaded files with nginx?

I want to log names (with full paths) of all uploaded files. Is it possible to do this with only nginx? os: CentOS 7.1 nginx: 1.6.3 Parameters for sending files in nginx.conf: sendfile on; ...
1
vote
1answer
41 views

is there a tool for windows 7 that can find which program is modifying a particular file [duplicate]

My system is infected by a malware that keeps modifying a particular configuration file. Is there a way/tool to find out which program is making change to a particular file? I am simply looking for a ...
4
votes
7answers
2k views

Web Application Vulnerability Scanner suggestions? [closed]

I'm looking for a new tool for the ol' admin toolkit and would value some suggestions. I would like to do some "automated" testing of handful of websites for XSS (cross site scripting) vulns, along ...
0
votes
1answer
1k views

How to enable connection security for WMI firewall rules when using VAMT 2.0?

I want to use VAMT 2.0 to install product keys and active software in remote machines. Everything works fine as long as the ASync-In, DCOM-In, and WMI-In Windows Firewall rules are enabled and the ...
0
votes
1answer
41 views

Allowing services to specific hosts using firewalld

Introduction On my database server (CentOS 7) I want to allow access to port 3306 (MySQL) from specific web front-ends (10.10.40.6 and 10.10.40.7 in my example). On top of that I want to allow access ...
0
votes
0answers
24 views

Security implications of wide WAN subnet

I have a server at OVH and say my public IP adress is xx.xx.xx.81 and the gateway is at xx.xx.xx.254. To reach the gateway, I need pfSense to be configured static WAN IP with xx.xx.xx.81/24, i.e. the ...
3
votes
2answers
1k views

SSHD - blocking password authentication

On several systems I have this sshd_config Port 22 Protocol 2 PermitRootLogin no StrictModes yes PasswordAuthentication no ChallengeResponseAuthentication no MaxStartups 2 AllowUsers john joe Can ...
0
votes
1answer
968 views

SQL Server NETWORK SERVICE account permissions

My SQL Server Windows service is set to use the NETWORK SERVICE account. The server is installed to C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL. However looking at the ...
0
votes
0answers
11 views

Separate bridge for each VM?

I have been experimenting with network settings ever since I got a new dedicated server for some root-started unprivileged LXC containers a few months back and have finally arrived at what might be a ...
7
votes
3answers
3k views

What is HTTP COOK request method in my logs?

I'm seeing entries in my Apache logs like the following 178.216.185.210 - - [24/Feb/2014:11:46:40 -0500] "COOK /freesearch.php?portal=0a9&... HTTP/1.0" 303 589 "-" "Mozilla/4.0 (compatible; ...
0
votes
1answer
95 views

How can the mutt shell-escape feature be disabled?

We are thinking of offering mutt for our member's email client. The user's shell is instead the mutt application launched on their Maildir folder. It works great so far but one huge problem is the ...
3
votes
1answer
27 views

How to handle vulnerability searches in IIS?

I have a web server running an ASP.NET web application on IIS 8.5. I noticed that several 404 errors were logged by the application which are not related to my application in anyway. Here are few ...
1
vote
1answer
37 views

Secure connection errors without SSL

I have several users who are encountering messages about secure connections to the server when trying to access my website. We've had this on Mac (iphone, ipad and macbook w/ safari) & Windows ...
1
vote
1answer
36 views

Access to “Windows Security” logs for “eventlog” group

Security logs are not available for users in eventlog group. I've checked this down to security event log file. eventlog group has all permissions. Unfortunately I cannot add my user to ...
3
votes
2answers
916 views

Is it worth running nessus as well as OpenVAS?

Apparently OpenVAS originated as a fork of Nessus. It is very easy to install and use OpenVAS because it's, well, open. However, am I kidding myself if I just use that instead of Nessus? Should I ...
-6
votes
2answers
44 views

How to protect Windows Server 2008 r2 from persons, which have physical access to computer? [closed]

One server is available for other users, and we think that someone may steal passwords from it. I can not set a password on boot, because sometimes there is electricity failure, and UPS can hold it ...
3
votes
6answers
6k views

Why can't I drag/drop a file for editing in notepad in Windows Server 2008?

When notepad is run, I can drag/drop a file to open it, but then it can't save the file. When I run notepad elevated to save the file, I can no longer drag/drop to open the file. I understand its a ...
0
votes
1answer
34 views

How to deny access on files to several groups easily?

Currently I'm working with permissions on files on the network with Windows Server 2012 Active Directory as follows: I set up one domain controller, on the domain controller I create users and groups. ...
0
votes
1answer
26 views

Block an http referrer on the server level

I am seeing multiple fake http referrers to several sites on my server, which for the most part doesn't bother me, except that they distort visitor stats. I have filtered the questionable domains out ...
9
votes
6answers
10k views

Group Policy: Administrator Rights for Specific Users on Specific Computers

I'm a programmer stuck trying to administer an Active Directory setup for a small company. The Domain Controller is running Windows Small Business Server 2008. We have a staff of field workers using ...
2
votes
1answer
602 views

Node.js with SSL/TLS protocol v1.2

I would like to use TLS 1.2 on my node.js server. I'm currently using openssl 1.0.0e. If I upgrade to openssl 1.0.1, do I need to rebuild node.js to upgrade to TLS 1.2? Are there configuration or ...
0
votes
1answer
141 views

Reverse a command and disable su on Ubuntu

Whilst following an online guide on how to secure Ubuntu server, I ran this command on one of my test VM's. sudo dpkg-statoverride --update --add root admin 4750 /bin/su I know the intention of ...
0
votes
1answer
30 views

How to eliminate Security Warning message on EC2 Instance wizard

I've set up the AWS Free Tier, and configured a Windows Server. I took the defaults pretty much. There was 1 security group it created with 3 security rules it provided by default, and I didn't ...
1
vote
2answers
31 views

Opening outgoing ports on dedicated machine

I have a website where I have been working with another person on a game server listing site. It queries the game servers and shows information etc. Anyway upon talking to the creator of the script he ...
0
votes
0answers
80 views

Linux client for pki certificate auto enrollment from Windows CA

I just set up a Windows Server Certificate Authority. I would like to auto-enroll Ubuntu Linux computers for certificates. Can anyone share the available client options? I found this (old) technet ...
3
votes
8answers
1k views

Why do https connections take longer to establish than straight http connections?

Why is it that Secured HTTP Connection (https) is Slower then than typical HTTP (http)? Just interested in knowing only. Thanks.